cloud object storage - aws toolkit for visual studio...

AWS Toolkit for Visual StudioUser Guide

Version v1.30

AWS Toolkit for Visual Studio: User GuideCopyright © 2014 Amazon Web Services, Inc. and/or its affiliates. All rights reserved.

All trademarks not owned by Amazon are the property of their respective owners, who may or may not be affiliated with, connectedto, or sponsored by Amazon.

AWS services or capabilities described in AWS Documentation may vary by region/location. Click Getting Started with Amazon AWSto see specific differences applicable to the China (Beijing) Region.

AWS Toolkit for Visual Studio User Guide

http://docs.amazonaws.cn/en_us/aws/latest/userguide/services.html

Table of ContentsUsing the AWS Toolkit for Visual Studio ............................................................................................. 1

The AWS Toolkit for Visual Studio ............................................................................................. 1What's New in Version 1.3 ....................................................................................................... 2What's New in Version 1.1 ....................................................................................................... 2About Amazon Web Services .................................................................................................. 3

Setting Up the AWS Toolkit for Visual Studio ....................................................................................... 4Prerequisites ........................................................................................................................ 4Installation ........................................................................................................................... 4Specifying Credentials ............................................................................................................ 5

Managing Amazon EC2 Instances .................................................................................................... 8The Amazon Machine Images and Amazon EC2 Instances Views .................................................. 8Launching an Amazon EC2 Instance ....................................................................................... 10Connecting to an Amazon EC2 Instance .................................................................................. 11Ending an Amazon EC2 Instance ........................................................................................... 13

Managing Security Groups from AWS Explorer ................................................................................. 16Creating a New Security Group .............................................................................................. 16Adding Permissions to Security Groups ................................................................................... 17

Create an AMI from an Amazon EC2 Instance .................................................................................. 18Setting Launch Permissions on an Amazon Machine Image ................................................................ 20Amazon Virtual Private Cloud (VPC) ............................................................................................... 22

How to Create a VPC for Deployment with AWS Elastic Beanstalk ................................................ 22Deployment Using the AWS Toolkit ................................................................................................. 26

Deploying to AWS Elastic Beanstalk ........................................................................................ 26How to Deploy the PetBoard Application Using AWS Elastic Beanstalk .................................. 27How to Specify the AWS Security Credentials for Your Application ........................................ 35How to Republish Your Application to AWS Elastic Beanstalk Environment ............................ 35

Deploying to AWS CloudFormation ......................................................................................... 36Standalone Deployment Tool ................................................................................................. 42

Installation and Invocation ............................................................................................. 43Deployment Tool Configuration File Format ...................................................................... 45How to Update the Configuration for an Existing Deployment ............................................... 51Customizing the AWS CloudFormation Template Used for Deployment ................................. 52

Using the AWS CloudFormation Template Editor ............................................................................... 55Creating a New AWS CloudFormation Template Project ............................................................. 55Deploying an AWS CloudFormation Template ........................................................................... 57Estimating the Cost of Your Template Project ............................................................................ 59Formatting an AWS CloudFormation Template .......................................................................... 60

Using Amazon S3 from AWS Explorer ............................................................................................. 62Creating an Amazon S3 Bucket .............................................................................................. 62Managing Amazon S3 Buckets from AWS Explorer .................................................................... 63Uploading Files and Folders to Amazon S3 .............................................................................. 64Amazon S3 File Operations from AWS Toolkit for Visual Studio .................................................... 65

How to Create a Pre-Signed URL ................................................................................... 67Using DynamoDB from AWS Explorer ............................................................................................. 68

Creating an DynamoDB Table ................................................................................................ 68Viewing an DynamoDB Table as a Grid .................................................................................... 69Editing and Adding Attributes and Values ................................................................................. 70Scanning an DynamoDB Table ............................................................................................... 71

Amazon RDS from AWS Explorer ................................................................................................... 73Launch an Amazon RDS Database Instance ............................................................................ 73Create a Microsoft SQL Server Database within an RDS Instance ................................................ 78Amazon RDS Security Groups ............................................................................................... 79

Create an Amazon RDS Security Group ......................................................................... 79Set Access Permissions for an Amazon RDS Security Group ............................................. 80

Using Amazon SimpleDB from AWS Explorer ................................................................................... 82

Version v1.30iii


Using Amazon SQS from AWS Explorer .......................................................................................... 84Creating a Queue ................................................................................................................ 84Deleting a Queue ................................................................................................................. 85Managing Queue Properties .................................................................................................. 85Sending a Message to a Queue ............................................................................................. 85

Identity and Access Management ................................................................................................... 87Create and Configure an IAM User ......................................................................................... 87Create an IAM Group ........................................................................................................... 88Add an IAM User to an IAM Group .......................................................................................... 89Generate Credentials for an IAM User ..................................................................................... 90Create an IAM Role ............................................................................................................. 91Create an IAM Policy ............................................................................................................ 92

Document History ........................................................................................................................ 94

Version v1.30iv


Using the AWS Toolkit for VisualStudio

The AWS Toolkit for Visual StudioThe AWS Toolkit for Visual Studio is a plug-in for the Visual Studio 2010, 2012, and 2103 IDE that makesit easier for developers to develop, debug, and deploy .NET applications that use Amazon Web Services.Some of the features of the AWS Toolkit that enhance the development experience are:

• AWS Explorer

AWS Explorer enables you to interact with many of the AWS services from inside the Visual StudioIDE. Supported data services include Amazon Simple Storage Service (Amazon S3), Amazon SimpleDB,Amazon Simple Notification Service (Amazon SNS), Amazon Simple Queue Service (Amazon SQS),and Amazon CloudFront. AWS Explorer also provides access to Amazon Elastic Compute Cloud(Amazon EC2) management, AWS Identity and Access Management (IAM) user and policy management,and deployment to AWS CloudFormation.

AWS Explorer supports multiple AWS accounts, including IAM user accounts, and enables you to easilychange the displayed view from one account to another.

• Amazon EC2

From AWS Explorer, you can view available Amazon Machine Images (AMIs), create Amazon EC2instances from those AMIs, and then connect to those instances using Windows Remote Desktop.AWS Explorer also enables supporting functionality such as the capability to create and manage keypairs and security groups.

• Amazon DynamoDB

Amazon DynamoDB is a fast, highly scalable, highly available, cost-effective, nonrelational databaseservice. The AWS Toolkit for Visual Studio provides functionality for working with Amazon DynamoDBin a development context. With the Toolkit, you can create and edit attributes in Amazon DynamoDBtables and run Scan operations on tables.

• AWS CloudFormation

AWS CloudFormation makes it easy for you to deploy your .NET Framework application to AWS. AWSCloudFormation provisions the AWS resources needed by your application, which frees you to focuson developing the application's functionality.The AWS Toolkit for Visual Studio includes two ready-to-useAWS CloudFormation templates.

Version v1.301

AWS Toolkit for Visual Studio User GuideThe AWS Toolkit for Visual Studio

• AWS Identity and Access Management (IAM)

AWS Explorer supports IAM. From AWS Explorer, you can create new IAM users and policies, andattach policies to users.

• AWS SDK for .NET integration

The AWS Toolkit for Visual Studio installs the latest version of the AWS SDK for .NET. From VisualStudio, you can easily modify, build, and run any of the samples included in the SDK.

NoteToolkit for Visual Studio for Visual Studio 2008 is still available, but not supported. For moreinformation, see Installation (p. 4).

What's New in Version 1.3Added support for deployment to AWS Elastic Beanstalk

The Toolkit for Visual Studio now supports deployment of web applications and web sites to AWS ElasticBeanstalk in addition to the existing deployment support for AWS CloudFormation. To deploy to eitherservice, right-click your project in Solution Explorer and select 'Publish to AWS'; you can then select therequired service in the deployment wizard. If you have Amazon RDS instances, the deployment wizardfor AWS Elastic Beanstalk can also be used to allow connectivity between your deployed application andselected Amazon RDS instances.

Fast Redeployment

For projects that have been deployed previously, a new 'Republish to...' command is available in thecontext menu for a project in Solution Explorer. The command name changes to show where the projectwas last deployed (AWS Elastic Beanstalk environment or AWS CloudFormation stack) together with theenvironment or stack name. Selecting the command displays a dialog that summarizes the deploymentoptions that were last used. Clicking the Deploy button then starts project redeployment, without needingto use the full deployment wizard.

Support for Amazon RDS and Microsoft SQL Server

Amazon RDS support has been added to the AWS Explorer allowing you to manage Amazon RDS assetsfrom within Visual Studio. Amazon RDS instances that use Microsoft SQL Server can also be added toVisual Studio's Server Explorer.

AWS Standalone Deployment Tool Additions

The standalone AWS deployment tool has been updated to support deployments to AWS Elastic Beanstalkand AWS CloudFormation. For AWS CloudFormation stacks, the tool now also supports 'update stack'functionality.

What's New in Version 1.1The AWS Toolkit for Visual Studio adds the following new features.

AWS Standalone Deployment Tool

The AWS Toolkit for Visual Studio includes the AWS Standalone Deployment Tool. The deployment toolis a command line tool that enables you to deploy your application to AWS CloudFormation from outside

Version v1.302

AWS Toolkit for Visual Studio User GuideWhat's New in Version 1.3

of the Microsoft Visual Studio development environment. With the deployment tool, you can makedeployment an automatic part of your build process or include deployment in other scripting scenarios.

Redeployment to CloudFormation

Both the deployment wizard and the deployment tool can redeploy a new instance of your applicationover an already-running instance.

AWS GovCloud Support

You can designate AWS accounts as AWS GovCloud users. These users are then able to use the AWSGovCloud region.

Server-Side Encryption

You can specify whether an Amazon S3 object should use server-side encryption.You can specify thisfeature at the time that you upload the object or afterwards in the object's properties dialog box.

Customize Columns in AMI, Instance, and Volume Views

In AWS Explorer, you can customize which columns are displayed when you are viewing Amazon MachineImages (AMIs), Amazon EC2 instances, and EBS volumes.

Tagging of AMIs, Instances, and Volumes

From AWS Explorer, you can add tags and tag values to AMIs, Amazon EC2 instances, and EBS volumes.Tags that you add are automatically added as columns in AWS Explorer views, and as with other columns,you can hide these columns if you choose.

Pagination of result set returned by Amazon SimpleDB.

When you execute a query in Amazon SimpleDB, the Toolkit for Visual Studio displays only a single"page" of results—either the first 100 results or the number of results specified by the LIMIT parameter,if it is included in the query. The Toolkit for Visual Studio now enables you to fetch either an additionalpage of results or an additional ten pages of results.

Time Delayed Message Delivery in Amazon SQS

When you send an Amazon SQS message from the Toolkit for Visual Studio, you can now specify a timedelay before the message appears in the Amazon SQS queue.

Export Amazon SimpleDB Results to CSV

You can export the results of your Amazon SimpleDB queries to a CSV file.

About Amazon Web ServicesAmazon Web Services (AWS) is a collection of digital infrastructure services that developers can leveragewhen developing their applications. The services include computing, storage, database, and applicationsynchronization (messaging and queuing). AWS uses a pay-as-you-go service model.You are chargedonly for the services that you—or your applications—use. Also, to make AWS more approachable as aplatform for prototyping and experimentation, AWS offers a free usage tier. On this tier, services are freebelow a certain level of usage. For more information about AWS costs and the Free Tier, go to AWS FreeUsage Tiers. To obtain an AWS account, go to the AWS home page and click the Sign Up Now button.

Version v1.303

AWS Toolkit for Visual Studio User GuideAbout Amazon Web Services

http://amazonaws.cn/free/

http://amazonaws.cn/free/

https://portal.amazonaws.cn/gp/aws/developer/registration/index.html

Setting Up the AWS Toolkit forVisual Studio

This section steps you through how to install and configure the Toolkit for Visual Studio.

PrerequisitesThe Toolkit for Visual Studio has the following prerequisites.

• An AWS account. To obtain an AWS account, go to the AWS home page and click Sign Up Now. Thissign-up will enable you to use all the services offered by AWS.

• Supported operating systems: Microsoft Windows 8, Windows 7, and Windows Vista.

We recommend that you install the latest service packs and updates for the version of Windows thatyou are using.

• Visual Studio 2010 or later.

We recommend that you install the latest service packs and updates.

NoteWe recommend that you install Toolkit for Visual Studio on Visual Studio Professional, whichsupports all of the toolkit's features.You can install on Toolkit for Visual Studio Visual StudioExpress, but the installation includes only the AWS project templates and the StandaloneDeployment Tool (p. 42). In particular, Visual Studio Express does not support AWS Explorer.

InstallationIf you have Visual Studio 2010 or later, install the Toolkit for Visual Studio as follows:

To install the Toolkit for Visual Studio

1. Go to AWS Toolkit for Visual Studio and click AWS Toolkit for Visual Studio.

2. Run the installation wizard, which is packaged as an MSI.

Version v1.304

AWS Toolkit for Visual Studio User GuidePrerequisites

http://amazonaws.cn/

http://amazonaws.cn/visualstudio

• If your browser asks whether to save or run the MSI, select Run.

• If your browser automatically saves the MSI file to your system, navigate to the download directoryand use Windows Explorer to launch the MSI.

The MSI file name depends on the version, but it will look something likeAWSToolsAndSDKForNet_sdk-2.0.13.2-ps-2.0.13.2-tk-1.6.5.4.msi.

3. Follow the installation wizard's instructions to install the toolkit.

TipBy default, the installation wizard installs the Toolkit for Visual Studio files, including a setof samples, under the Program Files directory, which is a protected part of the file system.If you install the toolkit that directory, you must run Visual Studio with administrator privilegesto load the samples. To load the samples without administrator privileges, you can specifyan installation location that is not in a protected part of the file system.

NoteYou can install the Toolkit for Visual Studio for Visual Studio 2008 fromhttp://sdk-for-net.amazonwebservices.com/latest/AWSToolkitForVisualStudio2008.msi. However,this version of the toolkit is no longer supported.

Specifying CredentialsBefore you can use the Toolkit for Visual Studio, you must provide one or more sets of valid AWScredentials. These credentials allow you to access your AWS resources through the Toolkit for VisualStudio. They are also used to sign programmatic web services requests, which enables AWS to verifythat the request comes from an authorized source.

ImportantAWS credentials consist of an access key and a secret key. We recommend that you do not useyour account's root credentials. Instead, create one or more IAM users, and use those credentials.For more information, see Using IAM Users and Best Practices for Managing AWS Access Keys.

The Toolkit for Visual Studio supports multiple sets of credentials from any number of accounts. Eachset is referred to as a profile.When you add a profile to Toolkit for Visual Studio, it encrypts the credentialsand stores them in the SDK Store, which is also used by the AWS SDK for .NET and AWS Tools forWindows PowerShell. The SDK Store is separate from your project directories, so that it cannot beunintentionally committed to a public repository. To use the Toolkit for Visual Studio, you must add atleast one profile to the SDK Store.

To add a profile to the SDK Store

1. In Visual Studio, open AWS Explorer by clicking the View menu and selecting AWS Explorer.Youcan also display AWS Explorer by typing Ctrl+K, and then pressing the A key.

2. Click the "New Account Profile" icon to the right of the Profile list.

Version v1.305

AWS Toolkit for Visual Studio User GuideSpecifying Credentials

http://sdk-for-net.amazonwebservices.com/latest/AWSToolkitForVisualStudio2008.msi

http://blogs.amazonaws.cn/net/post/Tx2O8RZZ1RLE898/Using-IAM-Users-Access-Key-Management-for-NET-Applications-Part-2

http://docs.amazonaws.cn/general/latest/gr/aws-access-keys-best-practices.html

http://amazonaws.cn/documentation/sdkfornet/

http://amazonaws.cn/documentation/powershell/

http://amazonaws.cn/documentation/powershell/

3. Enter the following data in the New Account Profile dialog box.:

Profile Name(Required) The profile's display name.

Access Key ID(Required) The access key.

Secret Access Key(Required) The secret key.

Account Number(Optional) The credential's account number. The Toolkit for Visual Studio uses the accountnumber to construct Amazon resource names (ARNs).

Account Type(Required) The account type, which determines which regions are displayed in AWS Explorerwhen you specify this profile.

• Standard AWS Account – AWS Explorer displays standard regions, such as:

• AWS GovCloud (US) Account – AWS Explorer displays only the GovCloud region.

• Amazon AWS Account – China (Beijing) Region AWS Explorer displays only the China(Bejing) region.

4. To add the profile to the SDK Store, click OK . To use a profile in your project, select the profile nameand Toolkit for Visual Studio adds a reference to the profile to the project's App.config orWeb.config file.

Version v1.306


http://amazonaws.cn/govcloud-us/

After you have added the first profile:

• To add another profile, repeat the procedure.

• To delete a profile, select it and click the Delete Profile icon.

• To edit a profile, click the Edit Profile icon to display the Edit Profile dialog box.

For example, if you have rotated an IAM user's credentials—a recommended practice—you can editthe profile to update the user's credentials in the SDK Store. For more information, see IAM CredentialRotation.

You can also add profiles to the SDK Store when you create an AWS project. Before Visual Studio createsthe project files, it displays the AWS Access Credentials dialog box.You can either select an existingprofile from the SDK Store, or create a new one, which is then added to the store.

Version v1.307


http://docs.amazonaws.cn/general/latest/gr/aws-access-keys-best-practices.html#iam-user-access-keys

http://blogs.amazonaws.cn/net/post/Tx2DJQU2MKGR463/IAM-Credential-Rotation-Access-Key-Management-for-NET-Applications-Part-3

http://blogs.amazonaws.cn/net/post/Tx2DJQU2MKGR463/IAM-Credential-Rotation-Access-Key-Management-for-NET-Applications-Part-3

Managing Amazon EC2 Instances

Topics

• The Amazon Machine Images and Amazon EC2 Instances Views (p. 8)

• Launching an Amazon EC2 Instance (p. 10)

• Connecting to an Amazon EC2 Instance (p. 11)

• Ending an Amazon EC2 Instance (p. 13)

AWS Explorer provides detailed views of Amazon Machine Images (AMI) and Amazon Elastic ComputeCloud (Amazon EC2) instances. From these views, you can launch an Amazon EC2 instance from anAMI, connect to that instance, and finally either stop or terminate the instance, all from inside the VisualStudio development environment.The instances view also enables you to create AMIs from your instances;for more information, see Create an AMI from an Amazon EC2 Instance (p. 18).

The Amazon Machine Images and Amazon EC2Instances Views

From AWS Explorer, you can display views of Amazon Machine Images (AMIs) and Amazon EC2Instances. In AWS Explorer, expand the Amazon EC2 node. To display the AMIs view, right-click thefirst subnode, AMIs, and then click View on the context menu. To display the Amazon EC2 Instancesview, right-click the Instances node and select View.You can also display either view by double-clickingthe appropriate node.

• The views are scoped to the region that is specified in AWS Explorer, for example, the US East region.

• The views enable you to rearrange columns by clicking and dragging, and to sort the values in aparticular column by clicking the column heading.

• The views are configurable using the drop-downs and filter box in the area labeled Viewing at the topof the view. The initial view displays AMIs of any platform type (Windows or Linux) that are owned bythe account that is specified in AWS Explorer.

Show or Hide Columns

You can also configure which columns are displayed by clicking the Show/Hide drop-down at the top ofthe view. The set of columns that you select for display will persist if you close the view and reopen it.

Version v1.308

AWS Toolkit for Visual Studio User GuideThe Amazon Machine Images and Amazon EC2 Instances

Views

Tagging AMIs, Instances, and Volumes

The Show/Hide drop-down also enables you to add tags for AMIs or Amazon EC2 instances or forvolumes that you own. Tags are name-value pairs that enable you to attach metadata to your AMIs,instances, and volumes. Tag names are scoped both to your account and also separately to your AMIsand your instances. For example, you could use the same tag name for your AMIs and your instancesand there would be no conflict. Tag names are not case sensitive.

For more information about tags, go to Using Tags in the Amazon EC2 User Guide.

To add a tag

1. Type a name for the tag in the Add box. Click the green button with the plus sign (+), and then clickApply.

The new tag is displayed in italic, which indicates that no values have yet been associated with thattag.

In the list view, the tag name appears as a new column.When at least one value has been associatedwith the tag, then the tag is also visible in the AWS Console.

2. To add a value for the tag, double-click a cell in the column for that tag.The cell will become editable.Type the value for the tag.You can delete the tag value by double-clicking the cell and deleting thetext.

If you deselect the tag in the Show/Hide drop-down, the corresponding column disappears from theview. The tag is preserved, along with any tag values associated with AMIs, instances, or volumes.

NoteIf you deselect a tag in the Show/Hide drop-down, and that tag has no associated values,the AWS Toolkit will delete the tag entirely; that is, it will no longer appear in the list view orin the Show/Hide drop-down.To use that tag again, recreate it using the Show/Hide dialogbox.

Version v1.309

AWS Toolkit for Visual Studio User GuideThe Amazon Machine Images and Amazon EC2 Instances

Views

http://docs.amazonaws.cn/AWSEC2/latest/UserGuide/Using_Tags.html

https://console.amazonaws.cn/ec2

Launching an Amazon EC2 InstanceAWS Explorer provides all the functionality that you need to launch an Amazon EC2 instance. In thissection, we'll select an Amazon Machine Image (AMI), configure it, and then start it as an Amazon EC2instance.

To launch a Windows Server Amazon EC2 instance

1. At the top of the AMIs view, in the left-hand drop-down, select Amazon Images. In the right-handdrop-down, select Windows. In the filter box, type ebs for Elastic Block Storage. It may take a fewmoments for the view to refresh.

2. Select an AMI by right-clicking it, and then click Launch Instance from the context menu.

3. In the Launch New Amazon EC2 Instance dialog box, configure the AMI for your application.

Instance TypeSelect the type of the EC2 instance to launch.You can find a list of instance types and pricinginformation on the AWS website.

NameEnter a name for your EC2 instance. This name cannot be larger than 256 characters in length.

Key PairA key pair is a set of public/private encryption keys that are used to authenticate you when youconnect to the EC2 instance using Remote Desktop Protocol (RDP). Select a keypair for whichyou have access to the private key.You can also create a new key pair by selecting that optionfrom the drop-down list. If you create the keypair in the Toolkit, the Toolkit can store the privatekey for you.

Security GroupThe security group controls what type of network traffic the EC2 instance will accept.You shouldselect a security group that will allow incoming traffic on port 3389, that is the port that is usedby RDP, so that you can connect to the EC2 instance. For information about how to createsecurity groups using the Toolkit, see Creating a New Security Group (p. 16).

Instance ProfileThe instance profile is a logical container for an IAM role. When you select an instance profile,you associate the corresponding IAM role with the EC2 instance. IAM roles are configured withpolicies that specify access to particular AWS services and account resources. When an EC2instance is associated with an IAM role, application software that runs on the instance runs withthe permissions specified by the IAM role. This enables the application software to run withouthaving to specify any AWS credentials of its own, which makes the software more secure. Forin-depth information about IAM roles, go to the IAM User Guide.

Version v1.3010

AWS Toolkit for Visual Studio User GuideLaunching an Amazon EC2 Instance

http://amazonaws.cn/ec2/pricing/

http://docs.amazonaws.cn/IAM/latest/UserGuide/WorkingWithRoles.html

4. Click Launch.

In AWS Explorer, right-click the Instances subnode of Amazon EC2, and then click View on thecontext menu.The AWS Toolkit displays the list of Amazon EC2 instances associated with the activeaccount.You may need to click Refresh to see your new instance. When the instance first appears,it may be in a pending state. After a few moments, it transitions into a running state.

Connecting to an Amazon EC2 InstanceYou can use Windows Remote Desktop to connect to a Windows Server instance. For authentication,the AWS Toolkit enables you to retrieve the Administrator password for the instance, or you can simplyuse the stored keypair associated with the instance. In the following procedure, we'll use the storedkeypair.

To connect to a Windows Server instance using Windows Remote Desktop

1. In the EC2 instance list, right-click the Windows Server instance that you would like to connect to.From the context menu, click Open Remote Desktop.

Notice also the Get Windows Passwords menu item. This is the menu item you would use toauthenticate using the Administrator password.

Version v1.3011

AWS Toolkit for Visual Studio User GuideConnecting to an Amazon EC2 Instance

2. In the Open Remote Desktop dialog box, select Use EC2 keypair to log on, and then click OK.

If you did not store a keypair with the AWS Toolkit, you will need to specify the PEM file where thekeypair is stored.

3. The Remote Desktop window will open; you will not need to log on because authentication occurredwith the key pair.You will be running as the Administrator on the Amazon EC2 instance.

If the EC2 instance has only recently started, you may not be able to connect for two possible reasons.One possible reason is that the Remote Desktop service might not yet be up and running. Wait afew minutes and try again. Another possible reason is that password information has not yet beentransferred to the instance. In this case, you will see a message box similar to the following.

The following screenshot shows a user connected as administrator through remote desktop.

Version v1.3012

AWS Toolkit for Visual Studio User GuideConnecting to an Amazon EC2 Instance

Ending an Amazon EC2 InstanceThere are two ways that you can end a running Amazon EC2 instance from Visual Studio using the AWSToolkit: stopping the instance or terminating the instance. To stop the instance, the EC2 instance mustbe using an Elastic Block Storage (EBS) volume. If the EC2 instance is not using an EBS volume, thenyour only option is to terminate the instance.

If you stop the instance, data stored on the EBS volume is retained. If you terminate the instance, all datastored on the instance's local storage device will be lost. In either case, stop and terminate; you do notcontinue being charged for the EC2 instance. However, if you stop an instance, you will continue to becharged for the EBS storage that persists after the instance is stopped.

Another possible way to end an instance is to use Remote Desktop to connect to the instance, and thenuse Shutdown from the Windows Start menu.You can configure the instance to either stop or terminatein this scenario. See below.

To stop an Amazon EC2 instance

1. In AWS Explorer, expand the Amazon EC2 node, right-click the Instances subnode, and then clickView. In the Instances list, right-click the instance that you want to stop and select Stop from thecontext menu. A confirmation message box will appear. Click Yes to confirm that you want to stopthe instance.

Version v1.3013

AWS Toolkit for Visual Studio User GuideEnding an Amazon EC2 Instance

2. At the top of the Instances list, click the Refresh link to see the change in status of the Amazon EC2instance. Notice that because we stopped rather than terminated the instance, the EBS volume thatis associated with the instance is still active.

Terminated Instances Remain Visible

If you terminate an instance, the instance will continue to appear for a period of time in the Instance listalongside running or stopped instances. Eventually, AWS "reclaims" these instances and, at that point,they disappear from the list.You are not charged for instances that are in a terminated state.

To specify the behavior of an Amazon EC2 instance at shutdown

The AWS Toolkit enables you to specify whether an Amazon EC2 instance will stop or terminate ifShutdown is selected from the Start menu.

1. In the Instances list, right-click an Amazon EC2 instance, and then click Change shutdown behaviorin the context menu.

Version v1.3014


2. In the Change Shutdown Behavior dialog box, click either Stop or Terminate from the ShutdownBehavior drop-down.

Version v1.3015


Managing Security Groups fromAWS Explorer

The AWS Toolkit for Visual Studio enables you to create and configure security groups to use with AmazonElastic Compute Cloud (Amazon EC2) instances and AWS CloudFormation. When you launch AmazonEC2 instances or deploy an application to AWS CloudFormation, you specify a security group to associatewith the Amazon EC2 instances. (Deployment to AWS CloudFormation creates Amazon EC2 instances.)

A security group acts like a firewall on incoming network traffic. The security group specifies what typesof network traffic an Amazon EC2 instance will allow to be received. It can also specify that incomingtraffic will be accepted only from certain IP addresses or only from specified users or other security groups.

Creating a New Security GroupIn this section, we'll create a new security group. Note that initially after creation, the security group willnot have any permissions configured. Configuring permissions is handled through an additional operation.

To create a new security group

1. In AWS Explorer, beneath the Amazon EC2 node, right-click the Security Groups node, and thenclick View on the context menu.

2. In the EC2 Security Groups tab, click Create Security Group.

3. In the Create Security Group dialog box, enter a name and description for the new security group.Click OK.

Version v1.3016

AWS Toolkit for Visual Studio User GuideCreating a New Security Group

Adding Permissions to Security GroupsIn this section, we'll add permissions to the new security group to allow web traffic via the HTTP andHTTPS protocols.We'll also add a permission to allow other computers to connect using Windows RemoteDesktop Protocol (RDP).

To add permissions to a security group

1. In the upper pane of the EC2 Security Groups tab, select a security group.

2. In the lower pane of the EC2 Security Groups tab, click the Add Permission button.

3. In the Add IP Permission dialog box, select the Protocol, Port and Network radio button, and thenselect HTTP from the Protocol drop-down. The port range automatically adjusts to Port 80, whichis the default port for HTTP. The Source CIDR field defaults to 0.0.0.0/0, which specifies that HTTPnetwork traffic will be accepted from any external IP address. Click OK.

4. Repeat this process for HTTPS and RDP.Your security groups permissions should now look likethe following.

You could also set permissions to the security group by specifying a UserID and security group name.In this case, Amazon EC2 instances in this security group would accept all incoming network traffic fromAmazon EC2 instances in the specified security group. It is necessary to also specify the UserID as away to disambiguate the security group name; security group names are not required to be unique acrossall of AWS. For more information about security groups, go to the EC2 documentation.

Version v1.3017

AWS Toolkit for Visual Studio User GuideAdding Permissions to Security Groups

http://docs.amazonaws.cn/AWSEC2/latest/UserGuide/using-network-security.html

Create an AMI from an Amazon EC2Instance

From the Amazon EC2 Instances view, you can create Amazon Machine Images (AMI) from eitherrunning or stopped instances.

To create an AMI from an instance

1. Right-click the instance that you would like to use as the basis for your AMI. Click Create Image(EBS AMI) on the context menu.

2. In the Create Image dialog box, provide a unique name and a description. Click OK.

Version v1.3018


It may take a few minutes for the AMI to be created. Once it is created, it will appear in the AMIs view inAWS Explorer. To display this view, double-click the Amazon EC2 | AMIs node in AWS Explorer. Tosee your AMIs, click Owned By Me in the Viewing drop-down.You may need to click Refresh to seeyour new AMI.When the AMI first appears, it may be in a pending state. After a few moments, it transitionsinto an available state.

Version v1.3019


Setting Launch Permissions on anAmazon Machine Image

You can set launch permissions on your Amazon Machine Images (AMI) from the AMIs view in AWSExplorer. The Set AMI Permissions dialog box also enables you to copy permissions from existingAMIs.

To set permissions on an AMI

1. In the AMIs view in AWS Explorer, right-click an AMI, and then click Edit Permission on the contextmenu.

2. In the Set AMI Permissions dialog box, click one of the following:

• Add, and enter the account number for the AWS user to whom you are giving launch permission.

• Remove, after selecting the account number for an AWS user from whom you are removing launchpermission.

• Copy from, and select an AMI from the displayed list. The users who have launch permissionson the selected AMI will be given launch permissions on the current AMI.You can repeat thisprocess with additional AMIs from the Copy-from list to copy permissions from multiple AMIs intothe target AMI.

The Copy-from list contains only AMIs that are owned by the account that was active when theAMI view was displayed from AWS Explorer. As a result, the Copy-from list might not display anyAMIs if no other AMIs are owned by the active account.

Version v1.3020


Version v1.3021


Amazon Virtual Private Cloud (VPC)

Amazon Virtual Private Cloud (Amazon VPC) enables you to launch Amazon Web Services (AWS)resources into a virtual network that you've defined. This virtual network resembles a traditional networkthat you'd operate in your own data center, with the benefits of using the scalable infrastructure of AWS.For complete information on Amazon VPC, go to the Amazon Virtual Private Cloud User Guide.

The AWS Toolkit for Visual Studio enables a developer to access VPC functionality similar to that exposedby the AWS Management Console but from within the Visual Studio development environment. TheAmazon VPC node of AWS Explorer includes subnodes for the following areas. The items below link tothe relevant documentation in the Amazon VPC User's Guide.

• VPCs

• Subnets

• Elastic IPs

• Internet Gateways

• Network ACLs

• Route Tables

• Security Groups

Walkthrough: How to Create a Public-PrivateVPC for Deployment with AWS Elastic Beanstalk

This section describes how to create an Amazon VPC that contains a public subnet and a private subnet.The public subnet contains an Amazon EC2 instance that performs network address translation (NAT)to enable instances in the private subnet to communicate with the public internet. The two subnets mustreside in the same availability zone (AZ).

This is the minimal VPC configuration required to deploy an AWS Elastic Beanstalk environment withina VPC. In this scenario, the Amazon EC2 instances that host your application reside in the private subnet,and the Elastic Load Balancer that routes incoming traffic to your application resides in the public subnet.

For more information about Network Address Translation (NAT), go to NAT Instances in the AmazonVirtual Private Cloud User Guide.

For an example of how to configure your deployment to use a VPC, see Deploying to AWS ElasticBeanstalk (p. 26)

Version v1.3022

AWS Toolkit for Visual Studio User GuideHow to Create a VPC for Deployment with AWS Elastic

Beanstalk

http://docs.amazonaws.cn/AmazonVPC/latest/UserGuide/

https://console.amazonaws.cn/vpc/home

http://docs.amazonaws.cn/AmazonVPC/latest/UserGuide/VPC_Introduction.html

http://docs.amazonaws.cn/AmazonVPC/latest/UserGuide/VPC_Subnets.html

http://docs.amazonaws.cn/AmazonVPC/latest/UserGuide/vpc-ip-addressing.html

http://docs.amazonaws.cn/AmazonVPC/latest/UserGuide/VPC_Internet_Gateway.html

http://docs.amazonaws.cn/AmazonVPC/latest/UserGuide/VPC_ACLs.html

http://docs.amazonaws.cn/AmazonVPC/latest/UserGuide/VPC_Route_Tables.html

http://docs.amazonaws.cn/AmazonVPC/latest/UserGuide/VPC_SecurityGroups.html

http://docs.amazonaws.cn/AmazonVPC/latest/UserGuide/VPC_NAT_Instance.html

To create a public-private subnet VPC

1. In the Amazon VPC node in AWS Explorer, double-click the VPCs subnode, then click Create VPC.

2. Configure the VPC as follows.

• Enter a name for your VPC.

• Select the With Public Subnet and the With Private Subnet check boxes.

• From the Availability Zone drop-down list box for each subnet, select an availability zone (AZ).Ensure that you use the same AZ for both subnets.

• For the private subnet, in NAT Key Pair Name, provide a key pair. This key pair is used for theAmazon EC2 instance that performs network address translation from the private subnet to thepublic Internet.

• Select the check box, Configure default security group to allow traffic to NAT

Click OK.

You can view the new VPC in the VPCs tab in AWS Explorer.

The NAT instance might take a few minutes to launch. Once it is available, you can view it by expandingthe Amazon EC2 node in AWS Explorer and then double-clicking the Instances subnode.

Version v1.3023


Beanstalk

An Amazon Elastic Block Store volume is automatically created for the NAT instance. For more informationabout Elastic Block Store, go to Amazon Elastic Block Store (EBS) in the Amazon Elastic Compute CloudUser Guide.

If you deploy an application to an AWS Elastic Beanstalk environment (p. 26), and choose to launch theenvironment in a VPC, the Toolkit will prepopulate the Publish to AWS dialog with the configurationinformation for your VPC.

The Toolkit only prepopulates the dialog with information from VPCs that were created in the Toolkit. Ifthe VPC, was created using the AWS Management Console, the Toolkit will not use it to prepopulate thedialog. The reason is that, when the Toolkit creates a VPC, it tags the components of the VPC so that itcan access their information.

The screenshot below from the Deployment Wizard shows an example prepopulated dialog.

To delete a VPC

To delete the VPC, you must first terminate any Amazon EC2 instances in the VPC.

1. If you have deployed an application to an AWS Elastic Beanstalk environment within the VPC, deletethe environment. This will terminate any Amazon EC2 instances that are hosting your applicationalong with the Amazon Elastic Load Balancer.

Note that if you attempt to directly terminate the instances that are hosting your application, withoutdeleting the environment, the AWS Auto Scaling service will automatically create new instances toreplace the deleted ones. For more information, go to the AWS Auto Scaling Developer Guide.

2. Delete the NAT instance for the VPC.

You do not need to delete the Amazon Elastic Block Store (EBS) volume associated with the NATinstance in order to delete the VPC. However, if you do not delete the volume, you will continue tobe charged for it even if you delete the NAT instance and the VPC.

3. Finally, use the Delete link in the VPC tab to delete the VPC itself.

Version v1.3024


Beanstalk

http://docs.amazonaws.cn/AWSEC2/latest/UserGuide/AmazonEBS.html

http://docs.amazonaws.cn/AutoScaling/latest/DeveloperGuide/WhatIsAutoScaling.html

4. Click OK in the Delete VPC dialog.

Version v1.3025


Beanstalk

Deployment Using the AWS Toolkit

The AWS Toolkit for Visual Studio supports application deployment to AWS Elastic Beanstalk containersor AWS CloudFormation stacks.

• Deploying to AWS Elastic Beanstalk (p. 26) and Deploying to AWS CloudFormation (p. 36) describehow to use the Visual Studio IDE to deploy applications to the AWS Elastic Beanstalk and AWSCloudFormation stacks.

• Standalone Deployment Tool (p. 42) describes how to use the standalone deployment tool to deployto either AWS Elastic Beanstalk containers or AWS CloudFormation stacks from a command window.

NoteIf you are using Visual Studio Express Edition:

• You can use the Standalone Deployment Tool (p. 42) to deploy applications to AWS ElasticBeanstalk containers or AWS CloudFormation stacks.

• You can use the AWS Management Console to deploy applications to AWS Elastic Beanstalkcontainers.

For either approach, you must first create a web deployment package. For more informationsee: How to: Create a Web Deployment Package in Visual Studio.

Deploying to AWS Elastic BeanstalkAWS Elastic Beanstalk is a service that simplifies the process of provisioning AWS resources for yourapplication. AWS Elastic Beanstalk provides all of the AWS infrastructure required to deploy yourapplication. This infrastructure includes:

• Amazon EC2 instances that host the executables and content for your application.

• An Auto Scaling group to maintain the appropriate number of Amazon EC2 instances to support yourapplication.

• An Elastic Load Balancer that routes incoming traffic to the Amazon EC2 instance with the mostbandwidth.

For more information about AWS Elastic Beanstalk, go to the AWS Elastic Beanstalk documentation.

Version v1.3026

AWS Toolkit for Visual Studio User GuideDeploying to AWS Elastic Beanstalk

http://docs.amazonaws.cn/elasticbeanstalk/latest/dg/using-features.deployment.newapp.html

http://msdn.microsoft.com/en-us/library/dd465323.aspx

http://docs.amazonaws.cn/elasticbeanstalk/latest/dg/Welcome.html

Topics

• How to Deploy the PetBoard Application Using AWS Elastic Beanstalk (p. 27)

• How to Specify the AWS Security Credentials for Your Application (p. 35)

• How to Republish Your Application to AWS Elastic Beanstalk Environment (p. 35)

How to Deploy the PetBoard Application UsingAWS Elastic BeanstalkThis section describes how to deploy an application to AWS, using AWS Elastic Beanstalk to provisionthe resources for the application. The application we'll use is the PetBoard sample that is included withthe AWS SDK for .NET. The SDK is installed automatically when you install the Toolkit for Visual Studio.PetBoard is also available as a separate download from the AWS website.

You can find the PetBoard application in the Samples directory beneath the SDK install directory. TheSDK is usually installed in the Program Files directory or Program Files (x86) on Windows 64-bit.

NoteIf PetBoard is installed under Program Files, you will need to run Visual Studio with administratorprivileges in order to open the sample. If you are not running with administrator privileges, VisualStudio will ask you if you want to restart the Visual Studio application with administrator privilegesenabled.The requirement for administrator privileges is not because of PetBoard itself, but because, inthis case, PetBoard is installed beneath Program Files.

To open PetBoard

1. Click the File menu, and then click Open | Project/Solution.

2. In the Open Project dialog box, navigate to the PetBoard sample directory.

3. Select the PetBoard.sln file (Visual Studio 2010 or later), and then click Okay. The PetBoardsample will appear in Solution Explorer.

To deploy the PetBoard application using AWS Elastic Beanstalk

1. Specify the AWS security credentials for the PetBoard application.You should specify these in thePetBoard Web.config file. See How to Specify the AWS Security Credentials for YourApplication (p. 35) for instructions on how to specify credentials in the Web.config file.

Version v1.3027

AWS Toolkit for Visual Studio User GuideHow to Deploy the PetBoard Application Using AWS

Elastic Beanstalk

http://amazonaws.cn/articles/3592?_encoding=UTF8&jiveRedirect=1

These credentials could be different from the credentials that you use to do the deployment. Thecredentials for the deployment are specified in the deployment wizard described below.

2. In Solution Explorer, right-click the project node for the PetBoard sample and click Publish to AWS.

3. In the Publish to AWS | Template dialog box, select the AWS account that you want to use for thedeployment.You can also add a new account by clicking the button with the plus sign next to theaccount drop-down list.

The dialog box provides the option of performing an initial deployment of an application or redeployingan application that was deployed previously. The previous deployments may have been performedwith either the deployment wizard or the Standalone Deployment Tool (p. 42). If you choose aredeployment, there may be a delay while the wizard retrieves information from previous deploymentsthat are currently running.

For this example, we'll perform a new deployment.

In the Publish to AWS dialog box, select Deploy new application with template and then selectAWS Elastic Beanstalk. Click Next.

4. In the Publish to AWS | Application dialog box, the Toolkit has already provided a default namefor the application.You can change the default name if you choose. Also, you can provide an optionalDescription in the Application Details area of the dialog box. This description can be any text youchoose.

The Toolkit also provides a Deployment version label, which is based on the current date and time.You may change this version label, but the version label must be unique; the Toolkit checks theversion label for uniqueness.

Version v1.3028


Elastic Beanstalk

If you are using incremental deployment (see below), the Deployment version label is grayed out.For incremental deployments, the version label is formed from the Git commit ID. In this case, theversion label is unique because the commit ID derives from a SHA-1 cryptographic hash.

Use incremental deployment

With incremental deployment, the first time that you deploy your application, all application files arecopied to the server. If you later update some of your application files and redeploy, only the changedfiles are copied, which potentially reduces the amount of time required for redeployment. Withoutincremental deployment, all of your application files are copied to the server with each redeploymentwhether the files were changed or not. Select this check box to use incremental deployment.

Click Next.

5. In the Publish to AWS | Environment dialog box, enter a Name and Description for your AWSElastic Beanstalk environment. In this context, the term "environment" refers to the infrastructurethat AWS Elastic Beanstalk provisions for your application. As with the Application dialog box, theToolkit has filled in a default name, which you can change, and you can enter whatever text youchoose for the Description.

You also have the option of providing a subdomain of .elasticbeanstalk.com that will be theURL for your application. The Toolkit provides a default subdomain based on the environment name.

Click Next.

Version v1.3029


Elastic Beanstalk

6. In the Publish to AWS | AWS Options dialog box, configure the following.

• Select a Container type from the drop-down list.The container type specifies an Amazon MachineImage (AMI) for your application as well as the configurations for the auto scaling group, the loadbalancer, and other aspects of the environment in which your application will run.

• You can specify a custom AMI in the Use custom AMI field. If you specify a custom AMI, it willoverride the AMI in the container specified above. Specifying a custom AMI is optional; you canleave this field blank. For more information about how to create a custom AMI go to Using CustomAMIs in the AWS Elastic Beanstalk Developer Guide and Create an AMI from an Amazon EC2Instance (p. 18).

• In the Instance Type drop-down list, specify an Amazon EC2 instance type. For the PetBoardapplication, we recommend that you use Micro as this will minimize the cost associated withrunning the instance. For more information about Amazon EC2 costs, go to the Amazon EC2Pricing page.

• Select a key pair in the Key pair drop-down list.

• This dialog provides the option to select an IAM role. An IAM role provides applications and servicesaccess to AWS resources using temporary security credentials. For example, if your applicationrequires access to DynamoDB, it must use AWS security credentials to make an API request.Theapplication can use these temporary security credentials so you do not have to store long-termcredentials on an Amazon EC2 instance or update the EC2 instance every time the credentialsare rotated. In addition, AWS Elastic Beanstalk requires an IAM role to rotate logs to Amazon S3.

The IAM role list displays the roles available for your AWS Elastic Beanstalk environment. If youdo not have an IAM role, you can select Use the default role. In this case, AWS Elastic Beanstalkcreates a default IAM role and updates the Amazon S3 bucket policy to allow log rotation. If youchoose not to use the IAM role, you need to grant permissions for AWS Elastic Beanstalk to rotatelogs. For instructions, see Using a Custom Instance Profile. For more information about log rotation,see Configuring Containers with AWS Elastic Beanstalk. For more information about using IAMroles with AWS Elastic Beanstalk, see Using IAM Roles with AWS Elastic Beanstalk.

The credentials that you use for deployment must have permission to create the default IAM role.

Click Next.

Version v1.3030


Elastic Beanstalk

http://docs.amazonaws.cn/elasticbeanstalk/latest/dg/using-features.customami.html




http://docs.amazonaws.cn/elasticbeanstalk/latest/dg/AWSHowTo.iam.roles.logs.html#AWSHowTo.iam.roles.logs-custom

http://docs.amazonaws.cn/elasticbeanstalk/latest/dg/using-features.managing.container.html

http://docs.amazonaws.cn/elasticbeanstalk/latest/dg/AWSHowTo.iam.roles.aeb.html

How to Deploy to a VPC

This dialog provides the option to launch your application to a Virtual Private Cloud (VPC).You needto have already created your VPC using the VPC functionality in the Toolkit for Visual Studio or usingthe AWS Management Console If you created the VPC in the Toolkit, the Toolkit will populate thisdialog for you. If you created the VPC in the console, enter the information for your VPC into thedialog.

Key points for VPC Deployment:

• Your VPC needs at least two subnets: one public and one private.

• Specify the public subnet in the ELB Subnet drop-down menu. The Toolkit deploys the ElasticLoad Balancer for your application to the public subnet. The public subnet is associated with arouting table that has an entry that points to an Internet Gateway.You can recognize an InternetGateway because it has an ID that begins with "igw-", such as "igw-83cddaea". Public subnetsthat you create using the Toolkit have tag values that identify them as public.

• Specify the private subnet in the Instances Subnet drop-down menu. The Toolkit deploys theAmazon EC2 instances for your application to the private subnet.

• The Amazon EC2 instances for your application communicate from the private subnet to the Internetthrough an Amazon EC2 instance in the public subnet that performs Network Address Translation(NAT). To enable this communication, you will need a VPC security group that allows traffic to flowfrom the private subnet to the NAT instance. Specify this VPC security group in the Security Groupdrop-down menu.

For more information about how to deploy an AWS Elastic Beanstalk application to a VPC, go to theAWS Elastic Beanstalk Developer Guide.

Version v1.3031


Elastic Beanstalk

http://docs.amazonaws.cn/elasticbeanstalk/latest/dg/AWSHowTo-vpc-basic.html

https://console.amazonaws.cn/vpc/home?#s=route-tables

https://console.amazonaws.cn/vpc/home?#s=SecurityGroups

http://docs.amazonaws.cn/elasticbeanstalk/latest/dg/

7. In the Publish to AWS | Application Options dialog box, configure the following.

• Under Application Pool Options, in the Target runtime drop-down list, specify the version ofthe .NET Framework required by your application Possible options are:

• .NET Framework 2.0





If your application is 32-bit, select Enable 32-bit applications. For this walkthrough, set this optionto Enable 32-bit applications.

• Under Miscellaneous, in the Application health-check URL box, specify a URL that AWS ElasticBeanstalk will check to determine if your application is still responsive. This URL is relative to theroot server URL. For example, if the full URL is example.com/site-is-up.html, then youwould enter, /site-is-up.html for this setting. For the PetBoard sample application, leave thedefault setting of a forward slash (/).

• If you specify an Email address for notifications, AWS Elastic Beanstalk sends status notificationsto that address during the deployment process.You can leave Email address for notificationsblank.

• Use the Application Environment parameters (PARAM1-5) to provide input data to yourapplication.These values are made available to the deployed application through the appSettingsin the Web.config. For more information, go to the Microsoft MSDN library.

• In the Application Credentials section, select the AWS credentials under which the application(in this example, PetBoard) should run.These could be different than the credentials used to deployto AWS Elastic Beanstalk, that is, the credentials for the account selected on the first page of thewizard.

To use a different set of credentials than the ones that are used to deploy, select the second radiobutton and enter the Access Key and Secret Key.

To use the same credentials as those that are used to deploy, select the third radio button: Usecredentials for '<account name>' where <account name> is the account selected on the firstpage of the wizard.

To use the credentials for an AWS Identity and Access Management (IAM) user, select the fourthradio button and specify the user. To use an IAM user, you need to have 1) created the IAM userin the AWS Toolkit, and 2) stored the secret key for the user with the Toolkit for Visual Studio. For

Version v1.3032


Elastic Beanstalk

http://msdn.microsoft.com/en-us/library/610xe886.aspx

more information, see Create and Configure an IAM User (p. 87) and Generate Credentials for anIAM User (p. 90).

An IAM user could have more than one set of credentials stored with the Toolkit. If that is the case,you will need to select which credentials to use. Also, the root account could rotate the credentialsfor the IAM user, which would invalidate the credentials selected here. In this scenario, you wouldneed to redeploy the application and manually enter the new credentials for the IAM user.

Click Next.

8. If you have deployed Amazon RDS instances, a dialog box similar to the following appears as partof the deployment wizard. This dialog box enables you to add the Amazon EC2 instances for yourdeployment to one or more of the RDS security groups associated with your RDS instances. If yourapplication needs to access your RDS instances, you will need to enable this access either in thisdialog box or by otherwise setting the correct permissions on your RDS security groups. For moreinformation, see Amazon RDS Security Groups (p. 79)

If you are deploying to a VPC, this dialog will not appear because, for VPCs, RDS instances aremanaged by EC2 security groups.

Version v1.3033


Elastic Beanstalk

9. In the Publish to AWS | Review dialog box, review the options that you configured previously. Also,select Open environment status window when wizard closes.

If everything looks correct, click Deploy. Otherwise, click Back to return to a previous dialog box tomake any necessary changes.

NoteWhen you deploy the application, the active account will incur charges for the AWS resourcesused by the application.

You can save the deployment configuration to a text file that you can then use with standalone deploytool. To save the configuration, select Generate AWSDeploy configuration. Then, click ChooseFile and specify a file to which to save the configuration.You can also save off the configuration afterthe deployment completes, by right-clicking on the deployment in AWS Explorer and selecting SaveConfiguration from the context menu.

NoteThe deployment configuration includes the credentials that were used for deployment.Therefore, you should keep the configuration secure to avoid having the credentials fall intoenemy hands.

10. A status page for the deployment will open. It may take a few minutes for the deployment to complete.

When the deployment completes, the Toolkit will display an alert. This is useful because it allowsyou to focus on other tasks while the deployment is in progress.

You can click the Application URL link to connect to the PetBoard application.

11. To delete the deployment, expand the Elastic Beanstalk node in AWS Explorer, and then right-clickthe subnode for the deployment. Click Delete. AWS Elastic Beanstalk will begin the deletion process,which might take a few minutes. If you specified a notification email address in the deployment, AWSElastic Beanstalk will send status notifications for the delete process to this address.

Version v1.3034


Elastic Beanstalk

How to Specify the AWS Security Credentials forYour ApplicationThe account that you specify in the Publish to AWS | Template dialog box is the account that you usefor deployment to AWS Elastic Beanstalk. In addition, you also need to specify AWS security credentialsthat your application will use to access AWS services once it has been deployed.These credentials mightbe from the same account that you use to deploy the application or they might be from a different account.A best practice is to create an IAM user that has only the permissions required by your application andthen to use this IAM user's credentials.You should then add a profile for those credentials to the SDKStore. For more information, see Configuring AWS Credentials.

You can specify the account credentials for your application in the Web.config file's appSettings element.The preferred way to specify credentials is to reference the appropriate profile. The following examplespecifies credentials whose profile name is myProfile.

<appSettings>  <add key="AWSProfileName" value="myProfile"/></appSettings>

You can also specify credentials in in the Container area of the application environment after AWS ElasticBeanstalk has created the environment.

How to Republish Your Application to AWS ElasticBeanstalk EnvironmentYou can iterate on your application by making discrete changes and then republishing a new version toyour already-launched AWS Elastic Beanstalk Environment.

To republish your application

1. In Solution Explorer, right-click the project node for the PetBoard sample and select Republish toEnvironment 'PetboardEnv'.

Version v1.3035

AWS Toolkit for Visual Studio User GuideHow to Specify the AWS Security Credentials for Your

Application

http://docs.amazonaws.cn/AWSSdkDocsNET/latest/DeveloperGuide/net-dg-config-creds.html

2. A single dialog box appears. If you are not using incremental deployment, this dialog box enablesyou to specify a new version label. If you are using incremental deployment, a new version label isautomatically generated for you based on the Git commit ID of the new version of your application.

3. Click Deploy and the new version of you application will be published to the current environment.

When you republish, you do not have the option of using a new or different environment. Also, you donot have the option of switching between incremental and non-incremental deployment. If you would liketo change either of these aspects of your deployment. Select Publish to AWS (instead of Republish toEnvironment 'PetboardEnv') and then select Redeploy in the first screen of the deployment wizard.

You cannot republish if your application is in the process of launching or terminating. Wait for the launchor termination to complete before republishing.

Deploying to AWS CloudFormationAWS CloudFormation is a service that simplifies the process of provisioning AWS resources for yourapplication. The AWS resources are described in a template file. The AWS CloudFormation serviceconsumes this template and automatically provisions the necessary resources for you. For more informationabout AWS CloudFormation, go to the AWS CloudFormation documentation.

In this section, we'll deploy an application to AWS, using AWS CloudFormation to provision the resourcesfor the application.The application we'll use is the PetBoard sample, which is included with the AWS SDKfor .NET. The SDK is installed automatically when you install the AWS Toolkit for Visual Studio. PetBoardis also available as a separate download from the AWS website.

You can find the PetBoard application in the Samples directory beneath the SDK install directory. TheSDK is usually installed in the Program Files directory or Program Files (x86) on Windows 64-bit.

NoteIf PetBoard is installed beneath Program Files, you will need to run Visual Studio with administratorprivileges in order to open the sample. If you are not running with administrator privileges, VisualStudio will ask if you want to restart the Visual Studio application with administrator privilegesenabled.

To open PetBoard

1. Click the File menu and select Open | Project/Solution.

2. In the Open Project dialog box, navigate to the PetBoard sample directory.

3. Select the PetBoard.sln file (Visual Studio 2010 or later), and then click Okay. The PetBoardsample will appear in Solution Explorer.

Version v1.3036

AWS Toolkit for Visual Studio User GuideDeploying to AWS CloudFormation

http://amazonaws.cn/documentation/cloudformation/

http://amazonaws.cn/articles/3592?_encoding=UTF8&jiveRedirect=1

To deploy the PetBoard application using AWS CloudFormation

1. In Solution Explorer, right-click the project node for the PetBoard sample, and then click Publishto AWS.

2. In the Publish to AWS dialog box, select the profile that you wish to use for the deployment.Youcould also add a new profile by clicking Other. For more information about profiles, see SpecifyingCredentials (p. 5).

3. The dialog box provides the option of redeploying an application that was deployed previously—usingeither the deployment wizard or the standalone deployment tool—or deploying a new instance. Ifyou select to perform a redeployment, there may be a delay while the wizard retrieves informationfrom the previous deployment.

For this example, we'll deploy a new instance.

For deploying a new instance, the dialog box provides two AWS CloudFormation templates that youcan use: Load Balanced Template and Single Instance Template. These templates are includedwith the AWS Toolkit. Load Balanced Template provisions an Amazon EC2 instance with an AmazonElastic Load Balancer and an Amazon Auto Scaling Group. Single Instance Template provisionsjust a single Amazon EC2 instance.

Select Load Balanced Template, and then click Next.

Version v1.3037


4. In the AWS Options dialog box:

• Select an Amazon EC2 key pair from Key pair.

• You can leave SNS Topic blank. If you specify an SNS topic, AWS CloudFormation will sendstatus notifications during the deployment process.

• Leave Use custom AMI blank; the AWS CloudFormation template includes an AMI.

• Leave Instance Type set to Micro as this will minimize the cost associated with running theinstance. For more information about Amazon EC2 costs, go to the Amazon EC2 Pricing page.

• Specify a security group that has port 80 open. Applications deployed to AWS CloudFormationneed to have port 80 open because AWS CloudFormation uses port 80 to relay information regardingthe deployment. The default security group does not have port 80 open. If you have alreadyconfigured a security group with port 80 open, then specify that group. To learn how to create anappropriate security group, see Creating a New Security Group (p. 16). If the specified securitygroup does not have port 80 open, the wizard will ask if it should open port 80 for the specifiedsecurity group. If you say yes, port 80 will then be open for any Amazon EC2 instances that usethat security group.

Click Next.

Version v1.3038



5. In the Application Options dialog box, in the Application Credentials section, select the profileunder which the application (in this example, PetBoard) should run. It could be different than theprofile used to deploy to CloudFormation, that is, the profile that you specified on the first page ofthe wizard.

To use a different set of credentials than the ones that are used to deploy, select the second radiobutton and enter the Access Key and Secret Key.

To use the same credentials as those that are used to deploy, select the third radio button: Usecredentials from profile profile_name where profile_name is the profile selected on the firstpage of the wizard.

To use the credentials for an AWS Identity and Access Management (IAM) user, select the fourthradio button and specify the user. To use an IAM user, you need to have 1) created the IAM user inthe Toolkit for Visual Studio, and 2) stored the secret key for the user with the Toolkit. For moreinformation, see Create and Configure an IAM User (p. 87) and Generate Credentials for an IAMUser (p. 90).

Also, note that an IAM user could have more than one set of credentials stored with the Toolkit. Ifthat is the case, you will need to select which credentials to use. Finally, note that the root accountcould rotate the credentials for the IAM user, which would invalidate the credentials selected here.In this scenario, you would need to redeploy the application and manually enter the new credentialsfor the IAM user.

The following table describes the other options available in this dialog box. For PetBoard, you do notneed to change any of these from the defaults.

Version v1.3039


DescriptionKey and Value

These values are made available to the deployedapplication through the appSettings element in theWeb.config file. For more information, go to the MicrosoftMSDN library.

PARAM1

PARAM2

PARAM3

PARAM4

PARAM5

Specifies the version of the .NET Framework that theapplication targets. Possible options are:






Target Runtime

Select if the application is 32-bit. Otherwise, leaveunselected.

Enable 32-bit applications

The URL that is used to "Health Check" the application.This URL is relative to the root server URL. For example,if the full path to the URL isexample.com/site-is-up.html, then you would enter,/site-is-up.html for this setting.

This setting is applicable only when using the load-balancedtemplate; this setting is ignored when using thesingle-instance template. The responsiveness of theapplication at this URL factors into the actions taken by theload balancer and auto-scaler.

Application health check URL

Click Finish.

Version v1.3040



6. In the Review dialog box, select Open environment status window when wizard closes.

You can save the deployment configuration to a text file which you can then use with standalonedeploy tool. To save the configuration, select Generate AWSDeploy configuration. Then, clickChoose File and specify a file to which to save the configuration.You can also save off theconfiguration after the deployment completes, by right-clicking on the deployment in AWS Explorerand selecting Save Configuration from the context menu.

NoteThe deployment configuration includes the credentials that were used for deployment.Therefore, you should keep the configuration secure to avoid having the credentials fall intothe wrong hands.

Click Deploy.

NoteWhen you deploy the application, the active account will incur charges for the AWS resourcesused by the application.

7. A status page for the deployment will open. It may take a few minutes for the deployment to complete.

When the deployment completes, the Toolkit displays an alert. This is useful because it allows youto focus on other tasks while the deployment is in progress.

In the Toolkit for Visual Studio, when the deployment completes, the status displayed will beCREATE_COMPLETE.

Version v1.3041


You can click the Application URL link to connect to the PetBoard application.

8. To delete the deployment, expand the CloudFormation node in AWS Explorer and right-click thesubnode for the deployment. Select Delete. AWS CloudFormation will begin the deletion process,which may take a few minutes. If you specified an SNS topic for the deployment, AWS CloudFormationwill send status notifications for the delete process to this topic.

Standalone Deployment ToolTopics

• Installation and Invocation (p. 43)

• Deployment Tool Configuration File Format (p. 45)

• How to Update the Configuration for an Existing Deployment (p. 51)

• Customizing the AWS CloudFormation Template Used for Deployment (p. 52)

The AWS Toolkit for Visual Studio includes the Standalone Deployment Tool. The deployment tool is acommand line tool that provides the same functionality as the deployment wizard in the Toolkit for VisualStudio.You can use the deployment tool in your build pipeline or in other scripts to automate deploymentsto AWS CloudFormation or AWS Elastic Beanstalk.

The deployment tool supports both initial deployments and redeployments. If you previously deployedyour application using the deployment tool, you can redeploy using the deployment wizard within VisualStudio. Similarly, if you have deployed using the wizard, you can redeploy using the deployment tool.

The deployment tool consumes a configuration file that specifies parameter values for the deployment.If you have deployed your application using the deployment wizard in Visual Studio, you can generate aconfiguration file for use with the deploy tool either from the last step in the wizard or from the AWSExplorer.

NoteThe deployment configuration includes the credentials that were used for deployment.Therefore,you should keep the configuration secure to avoid having the credentials fall into the wronghands.

Version v1.3042

AWS Toolkit for Visual Studio User GuideStandalone Deployment Tool

In order to deploy your web application using the deployment tool, you will need to package it as a .zipfile. For more information about how to package your application for deployment, go to the following topicat MSDN: How to: Create a Web Deployment Package in Visual Studio.

Installation and InvocationThe deployment tool is typically installed in the following directory:

C:\Program Files\AWS Tools\Deployment Tool\awsdeploy.exe

Or in the following directory on Microsoft Windows 64-bit:

C:\Program Files (x86)\AWS Tools\Deployment Tool\awsdeploy.exe

Invocation Syntax

awsdeploy [options] configFile

The configuration file must be the last item specified on the command line.

Command line options can be specified using a forward slash ("/") or a hyphen ("-").

Except for the "D" option, each command line option has a long form as well as a single letter abbreviation.For example, you can specify silent mode in any of the following ways.

/s-s/silent-silent

Other command line options follow a similar form. The following table shows the available command lineoptions.

Version v1.3043

AWS Toolkit for Visual Studio User GuideInstallation and Invocation

http://msdn.microsoft.com/en-us/library/dd465323.aspx

DescriptionOption

Do not output messages to the console./s, /silent, -s, -silent

Send more detailed information about the deployment to theconsole.

/v, /verbose, -v, -verbose

Do not create stack. Deploy to existing stack. Does not changethe AWS CloudFormation configuration.

/r, /redeploy, -r, -redeploy

Update the AWS CloudFormation configuration for an existingdeployment. Do not redeploy the application.

/u, /updateStack, -u, -updateStack

Block until deployment is complete. This is useful for scriptsthat need to take some action after the deployment iscomplete.

/w, /wait, -w, -wait

Log debugging information to the specified logfile./l <logfile>, /log <logfile>, -l <logfile>, -log<logfile>

Override a configuration setting from the command line. Seethe section of the configuration file for more information.

/D<key>=<value>, -D<key>=<value>

Output and Exit Codes

Warnings and errors are output to the console. Additional logging output is sent to the logfile if the logoption is specified.

The deployment tool uses the following exit codes.


Success0

Invalid argument1

Failed deployment3

If the deployment is successful, the deployment tool will output the URL for the deployed application.

Configuration File

The action of the deployment tool is specified using a configuration file. The Toolkit for Visual Studioincludes three sample configuration files.

• AWS CloudFormation single instance deployment

• AWS CloudFormation load-balanced deployment

• AWS Elastic Beanstalk deployment

Sample Web App

Also included is a sample web app (in a .zip file archive) that you can deploy using the deployment tool.You can find these files in the Samples subdirectory of the directory where the deployment tool is installed.

You can override settings in the configuration file by using the "D" command line option. The syntax is:

Version v1.3044

AWS Toolkit for Visual Studio User GuideInstallation and Invocation

/D<key>=<value>

or

-D<key>=<value>

You can specify the "D" option multiple times on the command line to override multiple configuration filesettings. If you repeat the same key multiple times on the command line with different values, thedeployment tool uses the last value specified.

Deployment Tool Configuration File FormatThe configuration files provide the same information that you would specify in the deployment wizard.The formatting of the configuration files divides the configuration into sections that correspond to thedialog boxes in the deployment wizard.

AWS CloudFormation Deployment Configuration FileThe following configuration parameters are taken from the load-balanced template.

General Settings


Relative path to the web deployment archive. This path isrelative to your working directory, that is, the directory fromwhich you invoke the deployment tool.

If you are updating an existing deployment (/updateStackswitch) this parameter is ignored.

DeploymentPackage = archive.zip

Target region.Region = us-east-1

The value for Template can be "SingleInstance" or"LoadBalanced" or a file path to a custom CloudFormationtemplate. For more information, see Customizing the AWSCloudFormation Template Used for Deployment (p. 52)

Template = LoadBalanced

Amazon Simple Storage Service (Amazon S3) bucket wherethe deployment materials will be stored. If this doesn't exist,it will be created. If you use the deployment wizard, itgenerates this name for you.

If you are redeploying after doing an deployment with thewizard, this parameter is ignored; the deployment functionalityautomatically uses the same bucket that was used in theoriginal deployment from the wizard.

UploadBucket =awsdeployment-us-east-1-samples

Amazon Elastic Compute Cloud (Amazon EC2) key pair forsigning into the instance. The key pair must exist beforedeployment. Note that the deployment wizard allows you tocreate the key pair during deployment.

KeyPair = default

Version v1.3045

AWS Toolkit for Visual Studio User GuideDeployment Tool Configuration File Format


The AWS Access Key and Secret Key used to create thestack and deploy the application to AWS CloudFormation.We recommend not using these parameters to specifycredentials. Instead, create a profile for the credentials anduse AWSProfileName to reference the profile. For moreinformation, see Specifying Credentials (p. 5).

AWSAccessKey =DEPLOYMENT_CREDENTIALS_HERE

AWSSecretKey =DEPLOYMENT_CREDENTIALS_HERE

The profile used to create the stack and deploy the applicationto AWS CloudFormation.

AWSProfileName = profile_name

Template Parameters

In addition to the following parameters, the load-balanced template supports numerous other parametersto customize load-balancing and auto-scaling behavior.


The type of Amazon EC2 instance to use.The Micro instanceshown here is the least expensive type of instance.

Template.InstanceType = t1.micro

The security group for the Amazon EC2 instance.This securitygroup must exist already and allow ingress on port 80 (HTTP).For information on how to create a security groups, seeManaging Security Groups from AWS Explorer (p. 16).

Template.SecurityGroup = default

These values are made available to the deployed applicationthrough the appSettings in the Web.config file. For moreinformation, go to the Microsoft MSDN library.

Environment.PARAM1 =





The Access Key and Secret Key that the deployed applicationuses to access AWS services. We recommend not usingthese parameters to specify credentials. Instead, create aprofile for the credentials and use AWSProfileName toreference the profile. For more information, see SpecifyingCredentials (p. 5).

Environment.AWSAccessKey =APP_CREDENTIALS_HERE

Environment.AWSSecretKey =APP_CREDENTIALS_HERE

The profile that the deployed application uses to access AWSservices. .


Container Settings

Version v1.3046


http://amazonaws.cn/ec2/instance-types/




SolutionStack specifies the version of Windows Server andInternet Information Server (IIS) to deploy to. Valid valuesare:

SolutionStack="64bit Windows Server 2008 R2 running IIS 7.5"

or

SolutionStack="64bit Windows Server 2012 run ning IIS 8"

If not otherwise specified the default is 64bit Windows Server2012 running IIS 8.You can use Container.Type as an aliasfor SolutionStack.

SolutionStack="64bit Windows Server2012 running IIS 8"

Specifies the target runtime that the .NET Framework mapsto. Possible values are 2.0 or 4.0.

The following .NET Framework versions are mapped to atarget runtime of 2.0:







The deployment wizard (p. 36) in the Toolkit for Visual Studioallows you to specify the .NET Framework version.The wizardthen maps the .NET Framework version to the appropriatetarget runtime version.

Container.TargetRuntime = 4.0

If the application is 32-bit, specify true. If the application is64-bit, specify false.

Container.Enable32BitApplications =false

The URL that is used to "Health Check" the application. ThisURL is relative to the root server URL. For example, if the fullURL is example.com/site-is-up.html, then you wouldenter, /site-is-up.html for this setting.

The setting is applicable only when you are using theload-balanced template; it is ignored when you are using thesingle-instance template. The responsiveness of theapplication at this URL affects the actions taken by the loadbalancer and auto scaler. If the application is unresponsiveor responds slowly, the load balancer will direct incomingnetwork traffic to other Amazon EC2 instances, and the autoscaler may add additional EC2 instances.

Container.ApplicationHealthcheckPath= /

Version v1.3047


Stack Creation settings


SNS topic to use for deployment messages.Settings.SNSTopic

The amount of time to allow for the creation of the stack. Avalue of zero means there is no time limit.

Settings.CreationTimeout = 0

If this value is true, the deployment tool tears down the stackif the deployment fails.

Settings.RollbackOnFailure = false

AWS Elastic Beanstalk Deployment Configuration FileThe following configuration parameters are for deployment using AWS Elastic Beanstalk.

For a walkthrough of using the Standalone Deployment Tool to deploy to AWS Elastic Beanstalk, go tothe AWS Elastic Beanstalk Developer Guide.

General Settings


Relative path to the web deployment archive. This pathis relative to your working directory—that is, the directoryfrom which you invoke the deployment tool.

If you are using incremental deployment (see below),this value specifies the root folder for the extracted webdeployment archive.

DeploymentPackage = archive.zip

If this value is specified, incremental deployment isenabled. The value itself specifies a location, such asC:\Temp\VS2008App1, where a Git repository will becreated to store the versioned contents of thedeployment package.

IncrementalPushLocation

Can be "AWS Elastic Beanstalk", "Elastic Beanstalk",or just "ElasticBeanstalk", as shown here.

Template = ElasticBeanstalk

Specifies a name for the application. This value isrequired.

Application.Name

Specifies an optional description for the application.Application.Description

Specifies a version string for the application. If you areusing incremental deployment, this value is ignored;AWS Elastic Beanstalk uses the Git commit ID for theversion string.

Application.Version

Target regionRegion = us-east-1

Amazon S3 bucket where the deployment materials willbe stored. If this doesn't exist, it will be created. If youuse the deployment wizard, it generates this name foryou.

UploadBucket =awsdeployment-us-east-1-samples

Version v1.3048


http://docs.amazonaws.cn/elasticbeanstalk/latest/dg/deploy_NET_standalone_tool.html

http://docs.amazonaws.cn/general/latest/gr/rande.html


Amazon EC2 key pair for signing into the instance. Thekey pair must exist before deployment. Note that thedeployment wizard allows you to create the key pairduring deployment.

KeyPair = default

AWS Access Key and Secret Key used to create thestack and deploy the application to AWS ElasticBeanstalk. We recommend not using these parametersto specify credentials. Instead, create a profile for thecredentials and use AWSProfileName to reference theprofile. For more information, see SpecifyingCredentials (p. 5).

AWSAccessKey =DEPLOYMENT_CREDENTIALS_HERE

AWSSecretKey =DEPLOYMENT_CREDENTIALS_HERE

The profile used to create the stack and deploy theapplication to AWS Elastic Beanstalk.


The names of the security groups for the Amazon EC2instance. If you specify multiple security groups, separatethem with commas.

/Daws:autoscaling:launchconfiguration.Se curityGroups=RDPOnly,HTTPOnly

The security groups must already exist and they mustallow ingress on port 80 (HTTP). For information on howto create security groups, see Managing Security Groupsfrom AWS Explorer (p. 16)

aws:autoscaling:launchconfiguration.SecurityGroups= default

Environment Settings


Specifies a name for your AWS Elastic Beanstalk environment.This value is required.

Environment.Name

Specifies an optional description for your environment.Environment.Description

Optionally specifies the URL prefix for your application. If youdo not specify this value AWS Elastic Beanstalk will derivethe prefix from your environment name.

Environment.CNAME

Container Settings

Version v1.3049



Specifies the target runtime that the .NET Framework mapsto. Possible values are 2.0 or 4.0.








The deployment wizard (p. 26) in the Toolkit for Visual Studioallows you to specify the .NET Framework version.The wizardthen maps the .NET Framework version to the appropriatetarget runtime version.

Container.TargetRuntime = 4.0

If the application is 32-bit, specify true. If the application is64-bit, specify false.

Container.Enable32BitApplications =false

The URL that is used to "Health Check" the application. ThisURL is relative to the root server URL. For example, if the fullURL is example.com/site-is-up.html, then you wouldenter, /site-is-up.html for this setting.

The setting is applicable only when you are using theload-balanced template; it is ignored when you are using thesingle-instance template. The responsiveness of theapplication at this URL affects into the actions taken by theload balancer and auto scaler. If the application isunresponsive or responds slowly, the load balancer will directincoming network traffic to other Amazon EC2 instances, andthe auto scaler may add additional Amazon EC2 instances.

Container.ApplicationHealthcheckPath= /

The type of Amazon EC2 instance to use.The Micro instanceshown here is the least expensive type of instance.

Container.InstanceType = t1.micro

Use this parameter to specify a custom Amazon MachineImage (AMI). For more information about how to create acustom AMI, go to Using Custom AMIs in the AWS ElasticBeanstalk Developer Guide and Create an AMI from anAmazon EC2 Instance (p. 18).

Container.AmiID

Use this parameter to optionally specify an email address fornotifications on deployment status.

Container.NotificationEmail

Version v1.3050





How to Update the Configuration for an ExistingDeploymentThe updateStack feature of the deployment tool enables you to modify the AWS CloudFormationconfiguration of an existing deployment. This configuration—the application's environment—comprisesthe cloud resources that your application runs on and has access to. The updateStack feature doesthis without changing the application itself. In other words, updateStack does not redeploy the application,it only updates the application's environment. In this way, the updateStack feature complements theredeployment feature; redeployment provides a way to update your application without changing theenvironment.

There are various scenarios in which you might use updateStack. For example, you might develop yourapplication using the single-instance template. Then, as the application nears production readiness, youcould update its configuration to use a load-balanced template, either for public beta testing or live releasedeployment. A related scenario would be a deployment that is using a load-balanced configuration, butwhich could be optimized by modifying some of the configuration parameters—for example, by increasingthe maximum number of supporting EC2 instances or changing the size of the instances, say from microto large.You could implement either of these scenarios—as well as others—using the updateStackfeature of the deployment tool.

There are scenarios in which you might use both the /updateStack option and the /redeploy option,effectively modifying both the application itself and the environment in which the application is running.In some cases, this approach is more efficient than just performing a regular deployment. For example,you might change your environment to add an Amazon S3 bucket and also update your application touse that bucket. With a combination of /updateStack and /redeploy, you could implement both changes,but leave any already provisioned Amazon EC2 instances up and running. A regular deployment wouldresult in all of the environment being taken down and rebuilt.

The updateStack feature is available only through the deployment tool. It is not available through thedeployment wizard in Visual Studio.You could use updateStack to update a deployment that wasdeployed initially using the deployment wizard, but not vice versa.

The invocation syntax for updating an existing deployment is similar to the syntax for a new deployment.

awsdeploy /updateStack [other options] updatedConfigFile

Keep the following in mind when attempting to update a deployment.

• You cannot update a deployment that is in the process of being created or being taken down.

• The specified config file must use the same value for the StackName parameter as the originaldeployment.

• You cannot change the region for your deployment using updateStack. However, you can changethe Availability Zones for your deployment.

• If you use updateStack to transition your deployment from SingleInstance to LoadBalanced, theendpoint for your deployment will necessarily change. In the SingleInstance case, the endpoint refersto an Amazon EC2 instance. However, in the LoadBalanced template, the endpoint refers to the ElasticLoad Balancer (ELB), a computer that distributes computing load across all the EC2 instances.Therefore,if you are using a CNAME record to associate a domain name with your deployment, you should updatethe CNAME record so that it points to the ELB of the load-balanced template.

The Deploy tool implements the updateStack feature by calling the AWS CloudFormation UpdateStackAPI. For more information about AWS CloudFormation, go to the AWS CloudFormation User Guide.

Version v1.3051

AWS Toolkit for Visual Studio User GuideHow to Update the Configuration for an Existing

Deployment

http://docs.amazonaws.cn/AWSCloudFormation/latest/APIReference/API_UpdateStack.html

http://docs.amazonaws.cn/AWSCloudFormation/latest/UserGuide/CHAP_Intro.html

Customizing the AWS CloudFormation TemplateUsed for DeploymentIn addition to modifying a deployment by specifying parameters in the configuration file for the standalonedeployment tool, you can also modify the deployment by providing your own custom AWS CloudFormationtemplate. By default, the deployment tool automatically uses one of a set of templates (p. 54) that arestored in Amazon Simple Storage Service (Amazon S3). This default set of templates includes twotemplates for each AWS region. One of these two is for deployment to a single Amazon Elastic ComputeCloud (Amazon EC2) instance; the other is for deployment to a load-balanced set of Amazon EC2instances.You can use these templates as a starting point for creating your own.

NoteYou are able to use custom templates only with the standalone deployment tool.You cannotuse custom templates with the deployment wizard in Visual Studio.

To create your own custom template

1. Copy the template that corresponds to your region and the type of deployment that you want to do.Links to each of the templates is provided at the end of this topic (p. 54).

2. Edit the template to modify it for your specific needs. The templates are text files, so you can editthem with any standard text editor. The deployment information in the templates is represented inJSON format. After editing the file, it's wise to revalidate the JSON formatting using a tool such asJSONLint.

The template file has three sections: Resources, Parameters, and Outputs.

To add resources to your deployment, add them to the Resources section of the template. Forexample, you could add an Amazon Relational Database Service (Amazon RDS) database or anAmazon Simple Notification Service (Amazon SNS) topic.To configure these resources at deploymenttime, add parameters to the Parameters section of the template.You can specify values for theseparameters in the config file for the standalone deployment tool.

Data that you specify in the Output section of the template is displayed in the AWS ManagementConsole.You can use the Output section to display post-deployment information about yourresources. For example, if you add an Amazon S3 bucket to the Resources section of the template,you can use the Outputs section to display the autogenerated name for the bucket.

For more information about editing AWS CloudFormation templates, go to the CloudFormation UserGuide.

3. Set the Template parameter in the deployment configuration file to the path to your customizedtemplate. The Template parameter is located under General Settings in the config file. Thepath that you specify could be the path to the file on your local hard drive or it could be a URL thatpoints to the location of the configuration file on a remote server. When you next run a deployment,the tool will use your template.

Required Data in the Template File

The deployment process requires that certain data be specified in the template file. While editing yourversion of the template, you must ensure that it continues to provide this data.The required data is locatedonly in the Parameters and Outputs sections of the template.

The following table shows the required parameters in the Parameters section of the template.

Version v1.3052

AWS Toolkit for Visual Studio User GuideCustomizing the AWS CloudFormation Template Used

for Deployment

http://docs.amazonaws.cn/general/latest/gr/rande.html

http://json.org/

http://jsonlint.com/

http://docs.amazonaws.cn/AWSCloudFormation/latest/UserGuide/resources-section-structure.html

http://docs.amazonaws.cn/AWSCloudFormation/latest/UserGuide/parameters-section-structure.html

http://docs.amazonaws.cn/AWSCloudFormation/latest/UserGuide/outputs-section-structure.html

http://amazonaws.cn/rds/

http://amazonaws.cn/sns/

http://docs.amazonaws.cn/AWSCloudFormation/latest/UserGuide/template-guide.html

http://docs.amazonaws.cn/AWSCloudFormation/latest/UserGuide/template-guide.html

http://docs.amazonaws.cn/AWSCloudFormation/latest/UserGuide/parameters-section-structure.html

Parameters Section of Template

MeaningName

The "API name" for the type of the Amazon EC2 instancesto use for the deployment. Examples are t1.micro for Microinstances or m1.xlarge for Extra Large instances. For a listof instance types and corresponding API names, see theAmazon EC2 detail page.

InstanceType

Which of your key pairs to use for the Amazon EC22instances.

KeyPair

The security group to use for the Amazon EC2 instances.Security Group

Amazon S3 bucket where the deployment files are uploaded.BucketName

Name of the config file that the deployment uses.ConfigFile

The Amazon Machine Image (AMI) that is used for thedeployment. For more information about how to create acustom AMI, go to Using Custom AMIs in the AWS ElasticBeanstalk Developer Guide and Create an AMI from anAmazon EC2 Instance (p. 18).

Note that the Host Manager software that is installed on AMIsthat are used in CloudFormation deployments is nowauto-updating. Therefore, if you derive a custom AMI fromone of the CloudFormation AMIs, you do not need to maintainthe Host Manager software. However, you still need to keepthe operating system and application software up to date.

AmazonMachineImage

The user data that the deployment provides to the deployedapplication.

UserData

The following table shows the required outputs in the Outputs section of the template.

Outputs Section of Template

MeaningName

The Amazon S3 bucket to which the deployment files wereuploaded.

Bucket

The name of the configuration file that was used for thedeployment.

ConfigFile

Boolean flag set to true, which indicates that this stack wascreated as part of a deployment from the AWS Toolkit forVisual Studio. This flag is also set to true if the deploymentis done from the standalone deployment tool.

VSToolkitDeployed

The URL for the deployed application.URL

Version v1.3053


for Deployment



http://docs.amazonaws.cn/AWSCloudFormation/latest/GettingStartedGuide/outputs-section-structure.html

Cloudformation Templates Used by the StandaloneDeployment ToolThe Standalone Deployment Tool (p. 42) uses the following AWS Cloudformation templates fordeployments. Each AWS Region has two templates: a single-instance template and a load-balancestemplate.

US East (Northern Virginia)

LoadBalanced.templateSingleInstance.template

US West (Northern California)

LoadBalanced-us-west-1.templateSingleInstance-us-west-1.template

US West (Oregon)

LoadBalanced-us-west-2.templateSingleInstance-us-west-2.template

EU (Ireland)

LoadBalanced-eu-west-1.templateSingleInstance-eu-west-1.template

Asia Pacific (Singapore)

LoadBalanced-ap-southeast-1.templateSingleInstance-ap-southeast-1.template

Asia Pacific (Tokyo)

LoadBalanced-ap-northeast-1.templateSingleInstance-ap-northeast-1.template

South America (Sao Paulo)

LoadBalanced-sa-east-1.templateSingleInstance-sa-east-1.template

If you need to create your own links to the templates, the format for each link is as follows:

http://vstoolkit.amazonwebservices.com/CloudFormationTemplates/<template name>

For example, for the single instance template for the US West region, the link would be:

http://vstoolkit.amazonwebservices.com/CloudFormationTemplates/SingleInstance-us-west-1.template

The links in the table show the HTTP protocol. However, the HTTPS protocol is also supported.

Version v1.3054


for Deployment

http://vstoolkit.amazonwebservices.com/CloudFormationTemplates/LoadBalanced.template

http://vstoolkit.amazonwebservices.com/CloudFormationTemplates/SingleInstance.template

http://vstoolkit.amazonwebservices.com/CloudFormationTemplates/LoadBalanced-us-west-1.template


http://vstoolkit.amazonwebservices.com/CloudFormationTemplates/LoadBalanced-us-west-2.template


http://vstoolkit.amazonwebservices.com/CloudFormationTemplates/LoadBalanced-eu-west-1.template

http://vstoolkit.amazonwebservices.com/CloudFormationTemplates/SingleInstance-eu-west-1.template

http://vstoolkit.amazonwebservices.com/CloudFormationTemplates/LoadBalanced-ap-southeast-1.template

http://vstoolkit.amazonwebservices.com/CloudFormationTemplates/SingleInstance-ap-southeast-1.template

http://vstoolkit.amazonwebservices.com/CloudFormationTemplates/LoadBalanced-ap-northeast-1.template

http://vstoolkit.amazonwebservices.com/CloudFormationTemplates/SingleInstance-ap-northeast-1.template

http://vstoolkit.amazonwebservices.com/CloudFormationTemplates/LoadBalanced-sa-east-1.template

http://vstoolkit.amazonwebservices.com/CloudFormationTemplates/SingleInstance-sa-east-1.template



Using the AWS CloudFormationTemplate Editor for Visual Studio

The AWS Toolkit for Visual Studio includes an AWS CloudFormation template editor and AWSCloudFormation template projects for Visual Studio. The supported features include:

• Creating new templates (either empty, or copied from an existing stack or sample template) using thesupplied AWS CloudFormation Template project type.

• Editing templates with automatic JSON validation, auto-completion, code folding, and syntax highlighting.

• Automatic suggestion of intrinsic functions and resource reference parameters for the field values inyour template.

• Menu items to perform common actions for your template from within Visual Studio: deploying thetemplate, estimating the cost of your template, and formatting your template.

Topics

• Creating a New AWS CloudFormation Template Project in Visual Studio (p. 55)

• Deploying an AWS CloudFormation Template in Visual Studio (p. 57)

• Estimating the Cost of Your AWS CloudFormation Template Project in Visual Studio (p. 59)

• Formatting an AWS CloudFormation Template in Visual Studio (p. 60)

Creating a New AWS CloudFormation TemplateProject in Visual Studio

To create a new AWS CloudFormation template project

1. On the Visual Studio menu, select File, New, and click Project to bring up the New Project dialog.

2. In the New Project dialog, click Installed Templates, AWS CloudFormation, then AWSCloudFormation Template.

Version v1.3055

AWS Toolkit for Visual Studio User GuideCreating a New AWS CloudFormation Template Project

3. In the lower pane of the New Project dialog, type your template project's Name.

4. Make one of the following choices for the Solution field:

• Create new solution. If you choose to create a new solution for your template, fill in the SolutionName field, and optionally choose a project Location.

• Add to solution. If you choose to add this template to your currently-opened solution, the Locationfield will automatically be set to the location of your current solution, and Solution Name will begreyed out.

5. Click OK to continue to the Select Project Source screen.

6. On the Select Project Source screen, choose the source of the template you will create.You canchoose from among the following:

• Create with empty template – generates a new, empty AWS CloudFormation template.

• Create from existing AWS CloudFormation stack – generates a template from an existing stack(the stack doesn't need to have a status of CREATE_COMPLETE) in your AWS account.

• Select sample template – generates a template from one of the AWS CloudFormation sampletemplates.

Version v1.3056

AWS Toolkit for Visual Studio User GuideCreating a New AWS CloudFormation Template Project

7. Click Finish to complete creating your AWS CloudFormation template project.

Deploying an AWS CloudFormation Template inVisual Studio

To deploy an AWS CloudFormation template

1. Right-click the template you want to deploy in Solution Explorer, and click Deploy to AWSCloudFormation to show the Deploy Template dialog.

Version v1.3057

AWS Toolkit for Visual Studio User GuideDeploying an AWS CloudFormation Template

Alternatively, you can click Deploy to AWS CloudFormation in the Template menu to deploy thetemplate that you're currently editing.

2. In the Deploy Template dialog, select the AWS account to use to launch the stack and the regionthat you want to launch it in.

3. Select Create New Stack if it is not already selected, and enter a name for your stack.

4. Choose any (or none) of the following options:

• SNS Topic – choose an existing SNS topic from the list to receive notifications about the stack'sprogress, or create a new one by typing an email address in the box and clicking Create NewTopic.

• Creation Timeout – choose how long AWS CloudFormation should allow for the stack to becreated before it is declared failed (and rolled back, unless the Rollback on failure option isunchecked.

• Rollback on failure – if you want the stack to rollback (delete itself) on failure, check this option.Leave it unchecked if you would like the stack to remain active, for debugging purposes, even ifit has failed to complete launching.

5. Click Finish to begin launching the stack with the name and options you selected.

Version v1.3058

AWS Toolkit for Visual Studio User GuideDeploying an AWS CloudFormation Template

Estimating the Cost of Your AWSCloudFormation Template Project in VisualStudio

Estimating the cost of your AWS CloudFormation stack provides you with an idea of how much theresources you include in your template will cost to operate per month. With the AWS Toolkit for VisualStudio, you can easily estimate the cost of the stack you are working on before deploying it.

To estimate the cost of your AWS CloudFormation stack

1. Right-click the template you want to estimate the cost of in Solution Explorer and click EstimateCost to show the Estimate Cost for Template dialog.

Alternatively, you can click Estimate Cost in the Template menu to estimate the cost of the templatethat you're currently editing.

2. Fill in the values of any parameters you have defined for your stack, and click Finish to estimate thecost of your stack.

3. A new screen will appear, displaying the AWS Simple Monthly Calculator. The values for the formdata will be filled in with information pulled from the template that you're editing. If you need to adjustany of the values, you can do so here.

Click the Estimate of Your Monthly Bill tab to display an itemized view of the estimated monthlycost of running your stack.

Version v1.3059

AWS Toolkit for Visual Studio User GuideEstimating the Cost of Your Template Project

http://calculator.s3.amazonaws.com/calc5.html

NoteCost estimates are calculated using the values that you enter and the current rates of AWSservices, which can vary over time. For more information about AWS pricing and estimatingcosts, see the whitepaper How AWS Pricing Works.

Formatting an AWS CloudFormation Templatein Visual Studio

To format your AWS CloudFormation template in Visual Studio

1. Right-click the template you want to format in Solution Explorer and click Format Template toformat your stack.

Alternatively, you can click Format Template in the Template menu to format the template thatyou're currently editing.

2. Your JSON code will be formatted so that its structure is clearly presented.

Version v1.3060

AWS Toolkit for Visual Studio User GuideFormatting an AWS CloudFormation Template

http://bit.ly/aws-pricing

Version v1.3061

AWS Toolkit for Visual Studio User GuideFormatting an AWS CloudFormation Template

Using Amazon S3 from AWSExplorer

Amazon Simple Storage Service (Amazon S3) enables you to store and retrieve data from any connectionto the Internet. All data stored by you on Amazon S3 is associated with your account and is, by default,accessible only by you. The AWS Toolkit for Visual Studio enables you to store data on Amazon S3 andto view, manage, retrieve, and distribute that data.

Amazon S3 uses the concept of buckets, which you can think of as being similar to file systems or logicaldrives. Buckets can contain folders—which are similar to directories—and objects, which are similar tofiles. In this section, we'll be using these concepts as we walk through the Amazon S3 functionalityexposed by the Toolkit for Visual Studio.

NoteTo use this tool, your IAM policy must grant permissions for the s3:GetBucketAcl action inaddition to actions such as s3:GetBucket and s3:ListBucket. For more information, seeOverview of AWS IAM Policies.

Creating an Amazon S3 BucketThe most fundamental unit of storage on Amazon S3 is the bucket.

To create a new Amazon S3 bucket

1. In AWS Explorer, right-click the Amazon S3 node, and then click Create Bucket from the contextmenu.

2. In the Create Bucket dialog box, enter a name for the bucket. Bucket names must be unique acrossthe entire AWS system. For additional constraints on Amazon S3 buckets, go to the Amazon S3documentation.

Version v1.3062

AWS Toolkit for Visual Studio User GuideCreating an Amazon S3 Bucket

http://docs.amazonaws.cn/IAM/latest/UserGuide/PoliciesOverview.html

http://docs.amazonaws.cn/AmazonS3/latest/dev/BucketRestrictions.html

http://docs.amazonaws.cn/AmazonS3/latest/dev/BucketRestrictions.html

3. Click OK.

Managing Amazon S3 Buckets from AWSExplorer

In AWS Explorer, you can right-click an Amazon S3 bucket to view supported operations.

Browse

Displays a view of the objects that the bucket contains. From here, you can create folders, or upload filesor entire directories/folders from your local computer. The lower pane displays status messages aboutthe upload process.You can clear these messages by clicking the icon labeled Clear.You can alsoaccess this view of the bucket by double-clicking the bucket name in AWS Explorer.

Properties

Displays a dialog box where you can do the following:

• Set Amazon S3 permissions that scope to 1) you as the bucket owner, or 2) all users who haveauthenticated on AWS, or 3) everyone with Internet access.

• Turn on logging for the bucket.

• Set up a notification using the Amazon Simple Notification Service (SNS) so that if you are usingReduced Redundancy Storage (RRS), you are notified if data loss occurs. RRS is an Amazon S3storage option that provides less durability than standard storage, but at reduced cost. For moreinformation, see the S3 FAQ.

• Create a static website using the data in the bucket.

Policy

Enables you to set up AWS Identity and Access Management (IAM) policies for your bucket. Go to theIAM documentation for more information and to see the use cases for IAM and S3.

Create Pre-Signed URL

Enables you to generate a time-limited URL that you can then distribute to provide access to the contentsof the bucket. For more information, see How to Create a Pre-Signed URL (p. 67) below.

Version v1.3063

AWS Toolkit for Visual Studio User GuideManaging Amazon S3 Buckets from AWS Explorer

http://amazonaws.cn/s3/faqs/#What_is_RRS

http://docs.amazonaws.cn/IAM/latest/UserGuide/IAM_Overview.html

http://docs.amazonaws.cn/IAM/latest/UserGuide/IAM_UseCases.html#UseCase_S3

http://docs.amazonaws.cn/AmazonS3/latest/dev/AccessPolicyLanguage_UseCases_s3_a.html

View Multi-Part Uploads

Enables you to view multipart uploads. Amazon S3 supports breaking large object uploads into parts tomake the upload process more efficient. For more information, go to the discussion of multipart uploadsin the Amazon S3 documentation.

Delete

Enables you to delete the bucket. Note that you can delete only buckets that are empty.

Uploading Files and Folders to Amazon S3AWS Explorer enables you to easily transfer files or entire folders from your local computer to any of yourbuckets.

NoteIf you upload files or folders that have the same name as files or folders that already exist in thecurrent Amazon S3 bucket, your uploaded files will overwrite the existing files without warning.

To upload a file or files to Amazon S3

1. In AWS Explorer, expand the Amazon S3 node, and double-click a bucket, or right-click the bucketand select Browse.

2. In the Browse view of your bucket, select Upload File or Upload Folder. A File-Open dialog boxappears.

3. In the File-Open dialog box, navigate to the files to upload, select them (you can select multiplefiles), and click Open. If you are uploading a folder, navigate to that folder, select it, and click Open.The Upload Settings dialog box appears.

The Upload Settings dialog enables you to set metadata and permissions on the files or folder thatyou are uploading. If you select the Make everything public check box, it is equivalent to settingOpen/Download permissions for Everyone.You can also choose to use Reduced RedundancyStorage for the uploaded files.

Version v1.3064

AWS Toolkit for Visual Studio User GuideUploading Files and Folders to Amazon S3

http://docs.amazonaws.cn/AmazonS3/latest/dev/uploadobjusingmpu.html

http://docs.amazonaws.cn/AmazonS3/latest/dev/uploadobjusingmpu.html



Amazon S3 File Operations from AWS Toolkitfor Visual Studio

If you select a file with the Amazon S3 view and right-click it, a context menu appears that enables youto perform various operations on the file.

Create Folder

Enables you to create a folder within the current bucket. Equivalent to clicking the Create Folder link atthe top of the Amazon S3 view.

Upload

Enables you to upload files or folders. Equivalent to the clicking the Upload File or Upload Folder linksat the top of the Amazon S3 view.

Open

Attempts to open the selected file in your default browser. Depending on the type of file and your defaultbrowser's capabilities, the file might not be displayed, but might simply be downloaded by your browserinstead.

Version v1.3065

AWS Toolkit for Visual Studio User GuideAmazon S3 File Operations from AWS Toolkit for Visual

Studio

Download

Opens a Folder-Tree dialog box to enable you to download the selected file.

Make Public

Sets permissions on the selected file to Open/Download, Everyone. Equivalent to setting Make Publicfor Everyone in the Upload Settings dialog box.

Delete

Deletes the selected files or folders.You can also delete files or folders by selecting them and pressingthe Delete key on your keyboard.

Change Storage Class

Sets the storage class to either Standard or Reduced Redundancy Storage (RRS).You can view thecurrent storage class setting by selecting the Properties menu item. See below.

Change Encryption

Enables you to set server side encryption on the file.You can view the current encryption setting byselecting the Properties menu item. See below.

Rename

Enables you to rename a file.You cannot rename a folder, however.

Cut | Copy | Paste

Enables you to cut, copy, and paste files or folders between folders or between buckets.

Properties

Displays a dialog box that enables you to set metadata and permissions for the file, as well as togglestorage for the file between Reduced Redundancy Storage (RRS) and Standard, and set Server SideEncryption for the file. This dialog box also displays an https link to the file. Clicking this link from insidethe AWS Toolkit for Visual Studio opens the file in your default browser. If you have permissions on thefile set to Open/Download, Everyone, then other people will be able to access the file through this link.However, rather than distributing this link, we recommend that you create and distribute pre-signed URLs.See below.

Create Pre-Signed URL

Version v1.3066

AWS Toolkit for Visual Studio User GuideAmazon S3 File Operations from AWS Toolkit for Visual

Studio

Enables you to create a time-limited pre-signed URL that you can distribute to enable other people toaccess the content that you have stored on Amazon S3.

How to Create a Pre-Signed URLThis section explains how to create a pre-signed URL.You can create pre-signed URLs for buckets orfor files within buckets. Other people can then use this URL to access the bucket or file. The URL is timelimited; it will expire after a period of time that you specify when you create the URL. After expiration, theURL will no longer enable access.

To create a pre-signed URL

1. In the Create Pre-Signed URL dialog box, set the expiration date and time for the URL. The defaultsetting is one hour from the current time.

2. Click the Generate button.

3. To copy the URL (which may be somewhat long) to the clipboard, click Copy.

Version v1.3067

AWS Toolkit for Visual Studio User GuideHow to Create a Pre-Signed URL

Using DynamoDB from AWSExplorer

DynamoDB is a fast, highly scalable, highly available, cost-effective, non-relational database service.DynamoDB removes traditional scalability limitations on data storage while maintaining low latency andpredictable performance. The AWS Toolkit for Visual Studio provides functionality for working withDynamoDB in a development context. For more information about DynamoDB, see the detail page onthe AWS website.

In the AWS Toolkit for Visual StudioAWS Toolkit for Visual Studio, AWS Explorer displays all theDynamoDB tables associated with the active AWS account.

Creating an DynamoDB TableUsing the Toolkit for Visual Studio, you can create a new DynamoDB table.

Version v1.3068

AWS Toolkit for Visual Studio User GuideCreating an DynamoDB Table

http://amazonaws.cn/dynamodb

To create a new table in AWS Explorer

1. In AWS Explorer, right-click Amazon DynamoDB, and then click Create Table. The Create Tablewizard appears.

2. Enter a table name in the Table Name field.

3. Enter a primary hash key attribute in the Hash Key Name field, and select the hash key type fromthe Hash Key Type option buttons. DynamoDB builds an unordered hash index using the primarykey attribute and an optional sorted range index using the range primary key attribute. For moreinformation about the primary hash key attribute, go to the Primary Key section in the AmazonDynamoDB Developer Guide.

4. Optionally, specify a range primary key by selecting Enable Range Key. Enter a range key attributein the Range Key Name field, and select a range key type from the Range Key Type option buttons.

5. Specify the number of read capacity units in the Read Capacity field, and specify the number ofwrite capacity units in the Write Capacity field.You must specify a minimum of 3 read capacity unitsand 5 write capacity units. For more information about read and write capacity units, go to ProvisionedThroughput in DynamoDB.

6. Optionally, enable a basic alarm to alert you when your table's request rates are too high. Select thepercentage of provisioned throughput per 60 minutes that needs to be exceeded before the alert.Provide an email address to send the alarm notification to.

7. Click OK to create the table.

For more information about DynamoDB tables, go to Data Model Concepts - Tables, Items, and Attributes.

Viewing an DynamoDB Table as a GridTo open a grid view of one of your DynamoDB tables, double-click the subnode in AWS Explorer thatcorresponds to the table. From the grid view, you can view the items, attributes, and values stored in thetable. Each row corresponds to an item in the table. The table columns correspond to attributes. Eachcell of the table holds the values associated with that attribute for that item.

Version v1.3069

AWS Toolkit for Visual Studio User GuideViewing an DynamoDB Table as a Grid

http://docs.amazonaws.cn/amazondynamodb/latest/developerguide/DataModel.html#DataModelPrimaryKey

http://docs.amazonaws.cn/amazondynamodb/latest/developerguide/ProvisionedThroughputIntro.html

http://docs.amazonaws.cn/amazondynamodb/latest/developerguide/ProvisionedThroughputIntro.html

http://docs.amazonaws.cn/amazondynamodb/latest/developerguide/DataModel.html#DataModelTableItemAttribute

An attribute can have a value that is a string or a number. Some attributes have a value that consists ofa set of strings or numbers. Set values are displayed as a comma-separated list enclosed by squarebrackets.

Editing and Adding Attributes and ValuesThe table grid view is editable; by double-clicking a cell, you can edit the values for the item's correspondingattribute. For set-value attributes, you can also add or delete individual values from the set.

The editing UI enables you not only to change the value of an attribute, but also to change the format ofthe value for an attribute—with some limitations. For example, any number value can be converted intoa string value. If you have a string value, the content of which is a number, such as "125", the editing UIenables you to convert the format of the value from string to number. Also, the editing UI enables you toconvert a single-value to a set-value. However, you cannot generally convert from a set-value to asingle-value; an exception is when the set-value has, in fact, only one element in the set.

The editing UI displays a green check mark and a red X. After editing the attribute value, click the greencheck mark to confirm your changes. If you want to discard your changes, click the red X.

After confirming your changes, the attribute value is displayed in red. This indicates that the attribute hasbeen updated, but that the new value has not been written back to the DynamoDB database. To write

Version v1.3070

AWS Toolkit for Visual Studio User GuideEditing and Adding Attributes and Values

your changes back to DynamoDB, click Commit Changes. Until you click Commit Changes, you canstill discard your changes by clicking Scan Table and then clicking No when the Toolkit asks if you wouldlike to commit your changes before the Scan.

Adding an Attribute

From the grid view, you can also add new attributes to the table. To add a new attribute, click AddAttribute at the top of the view.

In the Add Attribute dialog box, enter a name for your new attribute. Click OK.

In order for the new attribute to become part of the table, you must add a value to it for at least oneitem—and commit the change by clicking the Commit Changes button. If you want to discard the newattribute, just close the grid view of the table without clicking Commit Changes.

Scanning an DynamoDB Table

From the Toolkit, you can perform Scans on your DynamoDB tables. In a Scan, you define a set of criteriaand the Scan returns all items from the table that match your criteria. Scans are expensive operationsand should be used with care to avoid disrupting higher-priority production traffic on the table. Go to theAmazon DynamoDB Developer Guide for more recommendations on safely using the Scan operation.

To perform a Scan on an DynamoDB table from AWS Explorer

1. In the grid view, click the scan conditions: add button. A UI appears that enables you to edit a newScan clause.

Version v1.3071

AWS Toolkit for Visual Studio User GuideScanning an DynamoDB Table

http://docs.amazonaws.cn/amazondynamodb/latest/developerguide/

2. In the Scan clause editor, select the attribute to match against, how the value of the attribute shouldbe interpreted (string, number, set value), how it should be matched (Begins With, Contains, etc.),and what literal value it should match.

3. Add more Scan clauses as needed for your search.The Scan will return only those items that matchthe criteria from all of your Scan clauses. Note that the Scan will perform a case-sensitive comparisonwhen matching against string values.

4. On the button bar at the top of the grid view, click Scan Table.

To remove a Scan clause, click the red button with the white line to the right of each clause.

To return to the view of the table that includes all items, remove all Scan clauses and click Scan Tableagain.

Paginating Scan Results

At the bottom of the view are three buttons.

The first two blue buttons provide pagination for Scan results.The leftmost button will display an additionalpage of results. The second button displays an additional ten pages of results. In this context, a "page"is equal to 1 MB of content.

Export Scan Result to CSV

The rightmost button exports the results from the current Scan to a CSV file.

Version v1.3072

AWS Toolkit for Visual Studio User GuideScanning an DynamoDB Table

Amazon RDS from AWS Explorer

Amazon Relational Database Service (Amazon RDS) is a service that enables you to provision andmanage SQL relational database systems in the cloud. Amazon RDS supports three types of databasesystems.

• MySQL Community Edition

• Oracle Database Enterprise Edition

• Microsoft SQL Server (Express, Standard, or Web Editions)

For more information, see the Amazon Relational Database Service Getting Started Guide and the AmazonRelational Database Service User Guide.

Much of the functionality discussed here is also available through the AWS Management Console forAmazon RDS. For more information about using the console, see the Amazon Relational DatabaseService User Guide and the Amazon Relational Database Service Developer Guide.

Topics

• Launch an Amazon RDS Database Instance (p. 73)

• Create a Microsoft SQL Server Database within an RDS Instance (p. 78)

• Amazon RDS Security Groups (p. 79)

Launch an Amazon RDS Database InstanceWith AWS Explorer, you can launch an instance of any of the database engines that are supported byAmazon RDS.The following walkthrough shows the user experience for launching an instance of MicrosoftSQL Server Standard Edition, but the user experience is similar for all supported engines. Any differencesare called out in the text.

To launch an Amazon RDS Instance

1. In AWS Explorer, right-click the Amazon RDS node and select Launch DB Instance.

Version v1.3073

AWS Toolkit for Visual Studio User GuideLaunch an Amazon RDS Database Instance

http://docs.amazonaws.cn/AmazonRDS/latest/GettingStartedGuide/

http://docs.amazonaws.cn/AmazonRDS/latest/UserGuide/


https://console.amazonaws.cn/rds/home



http://docs.amazonaws.cn/AmazonRDS/latest/DeveloperGuide/

Alternatively, you can launch a new Amazon RDS instance by clicking Launch DB Instance in theDB Instances tab.

2. In the DB Engine Selection dialog box, select the type of database engine to launch.You may needto scroll the dialog box to see all the possible selections. For this walkthrough, we'll select MicrosoftSQL Server Standard Edition (sqlserver-se). Click Next.

3. In the DB Engine Instance Options dialog box, select the configuration options appropriate to howyou will use the database.

In the DB Engine Instance Options and Class section, you can specify the following settings.

License ModelThe license model varies depending on the type of database engine.

Version v1.3074


LicenseEngine Type

license-includedMicrosoft SQL Server

general-public-licenseMySql

bring-your-own-licenseOracle

DB Instance VersionSelect the version of the database engine you would like to use. If only one version is supported,that version is selected for you.

DB Instance ClassSelect the instance class for the DB engine. Different instance classes have different pricing,with more powerful instance classes being more expensive. See the pricing section of the AmazonRDS Detail Page for the most up-to-date pricing information.

Perform a multi AZ deploymentSelect this option to create a Multi-AZ deployment for enhanced data durability and availability.Amazon RDS provisions and maintains a standby copy of your database in a different AvailabilityZone for automatic failover in the event of a scheduled or unplanned outage. See the pricingsection of the Amazon RDS Detail Page for information about pricing for Multi-AZ deployments.This option is not supported for Microsoft SQL Server.

Upgrade minor versions automaticallySelect this option to have AWS automatically perform minor version updates on your RDSinstances for you.

In the RDS Database Instance section, you can specify the following settings.

Allocated StorageThe minimums and maximums for allocated storage depend on the type of database engine.

Maximum (GB)Minimum (GB)Engine

10245MySQL

102410Oracle Enterprise Edition

102430Microsoft SQL Server Express Edition

1024250Microsoft SQL Server Standard Edition

102430Microsoft SQL Server Web Edition

DB Instance IdentifierSpecify a name for the database instance. This name is not case sensitive and will appear inlowercase form in AWS Explorer.

Master User's NameSpecify a name for the administrator of the database instance.

Master User's PasswordSpecify a password for the administrator of the database instance.

Confirm PasswordIn this text area, simply re-enter the password to verify that it is correct.

Version v1.3075


http://amazonaws.cn/rds/#pricing



4. In the Additional Options dialog box, you can specify the following settings.

Database PortThis is the TCP port that the instance uses to communicate on the network. If your computeraccesses the Internet through a firewall, set this value to a port through which your firewall allowstraffic. Contact your systems administrator regarding which ports are appropriate for your firewall.

Availability ZoneUse this option if you want the instance to launch in a particular Availability Zone within yourregion. Note that the DB instance that you have specified might not be available in all zoneswithin a given region; if you receive a message that the instance size that you have chosen isnot supported in your selected Availability Zone, select a different zone.

RDS Security GroupSelect an RDS security group (or groups) to associate with your instance. RDS security groupsspecify the IP address, EC2 instances, and AWS accounts that are allowed to access yourinstance. For more information about RDS security groups and how to work with them in theToolkit for Visual Studio, see Amazon RDS Security Groups (p. 79).

The Toolkit for Visual Studio attempts to determine your current IP address and provides theoption of adding this address to the security groups that you choose to associate with yourinstance. However, if your computer accesses the Internet through a firewall, the IP addressthat the Toolkit generates for your computer may not be accurate.To determine which IP addressto use, consult your system administrator.

DB Parameter GroupFrom this drop-down list, select a DB parameter group to associate with your instance. Associatinga DB parameter group with your instance is optional. DB parameter groups enable you to changethe default configuration for the instance. For more information about DB parameter groups, goto the Amazon Relational Databse Service User Guide and also to this article .

When you have finished with this dialog box, click Next.

Version v1.3076


http://docs.amazonaws.cn/AmazonRDS/latest/UserGuide/USER_WorkingWithParamGroups.html

http://amazonaws.cn/articles/2935

5. This dialog box enables you to specify whether Amazon RDS should back up your instance and ifso, for how long the backup should be retained.You can also specify a window of time in which thebackups should occur.

This dialog box also enables you to specify if you would like Amazon RDS to perform systemmaintenance on your instance. Maintenance includes routine patches and minor version upgrades.

Note that the window of time that you specify for system maintenance cannot overlap with the windowspecified for backups.

When you have finished with this dialog box, click Next.

6. The final dialog box in the wizard allows you to review the settings that you have selected for yourinstance. If you need to modify any of the settings, use the Back button to move to the appropriatedialog box. If all the settings are correct, click Launch to launch your instance.

Version v1.3077


Create a Microsoft SQL Server Database withinan RDS Instance

Microsoft SQL Server is designed in such a way that, after launching an Amazon RDS instance, you needto create an SQL Server database within the RDS instance.

For information about how to create an Amazon RDS instance, see Launch an Amazon RDS DatabaseInstance (p. 73)

To create a Microsoft SQL Server database

1. In AWS Explorer, right-click the node that corresponds to your RDS instance for Microsoft SQLServer. From the context menu, select Create SQL Server Database.

2. In the Create SQL Server Database dialog box, enter the password that you specified when youcreated the RDS instance.Then enter a name for the Microsoft SQL Server database to create. ClickOK.

3. The AWS Toolkit creates the Microsoft SQL Server database and adds it to the Visual Studio ServerExplorer.

Version v1.3078

AWS Toolkit for Visual Studio User GuideCreate a Microsoft SQL Server Database within an RDS

Instance

Amazon RDS Security GroupsAmazon RDS Security Groups enable you to manage network access to your Amazon RDS instances.With security groups, you specify sets of IP addresses using CIDR notation, and only network trafficoriginating from these addresses is recognized by your Amazon RDS instance.

Amazon RDS Security Groups are not the same as Amazon EC2 security groups although they functionsimilarly. Also, it is possible to add an EC2 security group to your RDS security group. This has the effectthat any EC2 instances that are members of the EC2 security group are then able to access the RDSinstances that are members of the RDS security group.

For more information about Amazon RDS security groups, go to the Amazon Relational Database ServiceUser Guide.

For more information about Amazon EC2 security groups, go to the Amazon Elastic Compute Cloud UserGuide

Create an Amazon RDS Security GroupYou can create an RDS security group from the AWS Toolkit. If you use the AWS Toolkit to launch anRDS instance, the wizard will allow you to specify an RDS security group to use with your instance.Youcan create that security group before starting the wizard using the following procedure.

To create an Amazon RDS Security Group

1. In AWS Explorer, expand the Amazon RDS node, then right-click the DB Security Groups subnodeand select Create.

Alternatively, you could select Create Security Group from the Security Groups tab. If this tab isn'tvisible, right-click the DB Security Groups subnode and select View.

Version v1.3079

AWS Toolkit for Visual Studio User GuideAmazon RDS Security Groups

http://docs.amazonaws.cn/AmazonRDS/latest/UserGuide/Overview.RDSSecurityGroups.html

http://docs.amazonaws.cn/AmazonRDS/latest/UserGuide/Overview.RDSSecurityGroups.html



2. In the Create Security Group dialog box, enter a name and description for the security group. ClickOK.

Set Access Permissions for an Amazon RDSSecurity GroupBy default, a new Amazon RDS Security Group provides no network access.To enable access to AmazonRDS instances that use the security group, set its access permissions using the following procedure.

To set access for an Amazon RDS Security Group

1. In the Security Groups tab, select the security group to permit from the list view. If you do not seeyour security group listed, click Refresh. If you still do not see your security group, verify that yourSecurity Groups tab that you are viewing is for the correct AWS region; Security Group tabs inthe AWS Toolkit are region specific.

If no Security Group tabs are visible, right-click the DB Security Groups subnode in AWS Explorerand select View.

2. Click the Add Permission button.

3. In the Add Permission dialog box, you can specify your what IP addresses can access your RDSinstance using CIDR notation, or you can specify which EC2 security groups can access your RDSinstance. When specifying access by EC2 security group, you can specify that all EC2 instancesassociated with a particular AWS account have access, or you can select a particular EC2 securitygroup from the drop-down list.

Version v1.3080

AWS Toolkit for Visual Studio User GuideSet Access Permissions for an Amazon RDS Security

Group

The AWS Toolkit attempts to determine your IP address and auto-populate the dialog box with theappropriate CIDR specification. However, if your computer accesses the Internet through a firewall,you should consult your systems administrator for the correct CIDR because, in this case, the Toolkit'sCIDR determined by the toolkit may be inaccurate.

Version v1.3081

AWS Toolkit for Visual Studio User GuideSet Access Permissions for an Amazon RDS Security

Group

Using Amazon SimpleDB fromAWS Explorer

AWS Explorer displays all the Amazon SimpleDB domains associated with the active AWS account. FromAWS Explorer, you can create new Amazon SimpleDB domains or delete existing ones.

Executing Queries and Editing the Results

AWS Explorer can also display a grid view of a SimpleDB domain. From this view, you can view the items,attributes, and values in that domain.You can execute queries so that only a subset of the domain's itemsis displayed. This domain view is editable. By double-clicking a cell, you can edit the values for that item'scorresponding attribute.You can also add new attributes to the domain.

The domain displayed below is from the Amazon SimpleDB sample that ships with the AWS SDK for.NET.

To execute a query, edit the query in the text box at the top of the grid view, and then click Execute. Theview is filtered to show only the items that match the query.

Version v1.3082


To edit the values associated with an attribute, double-click the corresponding cell and the contents willbecome editable. After editing the values, click Commit Changes at the top of the view.

Adding an Attribute

To add a new attribute, click Add Attribute at the top of the view.

In order for the new attribute to become part of the domain, you must add a value for it to at least oneitem—and commit the change by clicking Commit Changes.

Paginating Query Results

At the bottom of the view are three buttons.

The first two, blue, buttons provide pagination for query results. Clicking the leftmost button displays anadditional page of results. Clicking the second button displays an additional ten pages of results. In thiscontext, a "page" is equal to 100 rows or the number of results specified by the LIMIT value if that isincluded in the query.

Export to CSV

Clicking the rightmost button exports the current results to a CSV file.

Version v1.3083


Using Amazon SQS from AWSExplorer

Amazon Simple Queue Service (SQS) is a flexible queue service that enables message passing betweendifferent processes of execution in a software application. Amazon SQS queues are located in the AWSinfrastructure, but the processes that are passing messages could be located locally, or on Amazon EC2instances, or on some combination of these. Amazon SQS is ideal for coordinating the distribution ofwork across multiple computers.

The AWS Toolkit for Visual Studio enables you to view Amazon SQS queues associated with the activeaccount, create and delete queues, and send messages via queues. By active account, we mean theaccount that is selected in AWS Explorer.

For more information about Amazon SQS, go to Introduction to Amazon SQS in the AWS documentation.

Creating a QueueYou can create a new Amazon SQS queue from AWS Explorer. The ARN and URL for the queue will bebased on the account number for the active account and the queue name that you specify at creation.

To create a queue

1. In AWS Explorer, right-click the Amazon SQS node, and then click Create Queue.

2. In the Create Queue dialog box, specify the queue name, the default visibility timeout, and the defaultdelivery delay. The default visibility timeout and the default delivery delay are specified in seconds.The default visibility timeout is the amount of time that a message will be invisible to potential receivingprocesses after a given process has acquired the message.The default delivery delay is the amountof time from the moment the message is sent to the moment it first becomes visible to potentialreceiving processes.

3. Click OK. The new queue appears as a subnode beneath the Amazon SQS node.

Version v1.3084

AWS Toolkit for Visual Studio User GuideCreating a Queue

http://docs.amazonaws.cn/AWSSimpleQueueService/latest/SQSDeveloperGuide/IntroductionArticle.html

Deleting a QueueYou can delete existing queues from AWS Explorer. Notes that if you delete a queue, any messagesassociated with the queue are no longer available.

To delete a queue

• In AWS Explorer, beneath the Amazon SQS node, right-click the queue that you want to delete,and then click Delete.

Managing Queue PropertiesYou can view and edit the properties for any of the queues displayed in AWS Explorer.You can alsosend messages to the queue from this properties view.

To manage queue properties

1. In AWS Explorer, beneath the Amazon SQS node, right-click the queue whose properties you wantto manage, and then click View Queue.

2. From the queue properties view, you can edit the visibility timeout, the maximum message size,message retention period, and default delivery delay. The default delivery delay can be overriddenwhen you send a message. In the screenshot below, the blurred out text is the account numbercomponent of the queue ARN and URL.

Sending a Message to a QueueFrom the queue properties view, you can send a message to the queue.

To send a message.

1. Click the Send button at the top of the queue properties view.

2. Enter the content for the message.You can optionally enter a delivery delay that will override thedefault delivery delay for the queue. In the example below, we have overridden the delay with a valueof 240 seconds. Click OK.

Version v1.3085

AWS Toolkit for Visual Studio User GuideDeleting a Queue

3. Wait for approximately 240 seconds (four minutes). The message will appear in the MessageSampling section of the of the queue properties view.

The timestamp in the queue properties view is the time that you clicked the Send button. It does notinclude the delay.Therefore, the time that the message actually appears in the queue and is availableto receivers could be later than this timestamp. The timestamp is displayed in your computer's localtime.

Version v1.3086

AWS Toolkit for Visual Studio User GuideSending a Message to a Queue

Identity and Access Management

Topics

• Create and Configure an IAM User (p. 87)

• Create an IAM Group (p. 88)

• Add an IAM User to an IAM Group (p. 89)

• Generate Credentials for an IAM User (p. 90)

• Create an IAM Role (p. 91)

• Create an IAM Policy (p. 92)

[For in-depth information of AWS Identity and Access Management (IAM), go to the IAM User Guide.]

AWS Identity and Access Management (IAM) enables you to more securely manage access to your AWSaccounts and resources.With IAM, you can create multiple users within your primary AWS account--knownas your root account. Each of these users can have their own credentials: password, Access Key ID, andSecret Key. Note, however, that all IAM users share a single account number.

You can manage the level of resource access that each IAM user has by attaching IAM policies to theuser. For example, you could attach a policy to an IAM user that gives them access to the Amazon S3service and related resources within your account, but which doesn't provide access to any other servicesor resources.

For more efficient access management, your can create IAM groups which are collections of users.Youcan then attach a policy to the group and it will affect all users that are members of that group.

In addition to managing permissions at the user and group level, IAM also supports the concept of IAMroles. Similarly to users and groups, you can attach policies to IAM roles.You can then associate theIAM role with an Amazon EC2 instance. Applications that run on the EC2 instance are able to accessAWS using the permissions provided by the IAM role. For more information about using IAM roles withthe Toolkit, see Create an IAM Role (p. 91).

Create and Configure an IAM UserIAM users enable you to grant others access to your AWS account. Because you are able to attachpolicies to IAM users, you can precisely limit what resources an IAM user can access and what operationsthey can perform on those resources.

Version v1.3087

AWS Toolkit for Visual Studio User GuideCreate and Configure an IAM User

http://docs.amazonaws.cn/IAM/latest/UserGuide/Welcome.html?r=215

A best practice is for all users that access an AWS account to access that account as IAM users—eventhe owner of the account. This ensures that if the credentials for one of the IAM users is compromised,just those credentials can be deactivated without needing to deactivate or change the root credentialsfor the account.

From the Toolkit, you can assign permissions to an IAM user either by attaching an IAM policy to the useror by assigning the user to a group. IAM users that are assigned to a group derive their permissions fromthe policies that are attached to the group. For more information, see Create an IAM Group (p. 88) andAdd an IAM User to an IAM Group (p. 89).

From the Toolkit, you can also generate AWS credentials (Access Key ID and Secret Key) for the IAMuser. For more information, see Generate Credentials for an IAM User (p. 90)

The AWS Toolkit for Visual Studio supports specifying IAM user credentials for accessing services throughAWS Explorer. Note that because IAM users typically do not have full access to all AWS services, someof the functionality in AWS Explorer might not be available in this scenario. If you use AWS Explorer tochange resources while the active account is an IAM user and then switch the active account to the rootaccount, the changes may not be visible until you refresh the view in AWS Explorer. To refresh the view,

click

For information about how to configure IAM users from the AWS Console, go to Working with Users andGroups in the IAM User Guide.

To create an IAM User

1. In AWS Explorer, expand the AWS Identity and Access Management node, right-click on the Userssubnode and select Create User...

2. Enter a name for the new IAM user in the Create User dialog. This is the IAM "friendly name". Forinformation about constraints on names for IAM users, go to the IAM User Guide. Click OK.

The new user appears as a subnode beneath Users under the AWS Identity and Access Managementnode.

For information on how to create a policy and attach it to the user, see Create an IAM Policy (p. 92)

Create an IAM GroupGroups provide a way of applying IAM policies to a collection of users. This sections describes how tocreate a group using the Toolkit.

For in-depth information about how to manage IAM users and groups, go to Working with Users andGroups in the IAM User Guide.

To create an IAM group

1. In AWS Explorer, under Identity and Access Management, right-click on the Groups subnode andselect Create Group...

2. Enter a name for the new IAM group and click OK.

Version v1.3088

AWS Toolkit for Visual Studio User GuideCreate an IAM Group

http://docs.amazonaws.cn/IAM/latest/UserGuide/Using_WorkingWithGroupsAndUsers.html


http://docs.amazonaws.cn/IAM/latest/UserGuide/Using_Identifiers.html#Identifiers_FriendlyNames

http://docs.amazonaws.cn/IAM/latest/UserGuide/LimitationsOnEntities.html



The new IAM group appears under the Groups subnode of Identity and Access Management.

For information on how to create a policy and attach it to the IAM group, see Create an IAM Policy (p. 92)

Add an IAM User to an IAM GroupIAM users that are members of an IAM group derive access permissions from the policies attached tothe group. The purpose of an IAM group is to make it easier to manage permissions across a collectionof IAM users. Therefore, to be useful, IAM groups need to contain IAM users.

For in-depth information about how the policies attached to an IAM group interact with the policies attachedto IAM users that are members of that IAM group, go to Managing IAM Policies in the IAM User Guide.

To add an IAM user to a IAM group

1. In AWS Explorer, under Identity and Access Management, right-click on the Users subnode andselect Edit. Note that you add IAM users to IAM groups from the Users subnode in AWS Explorerrather than from the Groups subnode.

2. In the Groups subtab, the left-hand pane displays the available IAM groups and the right-hand panedisplays the groups of which the specified IAM user is already a member.

To add the IAM user to a group, select the IAM group in the left-hand pane and click theright-single-arrow button, ">".

To remove the IAM user from a group, select the IAM group in the right-hand pane and click theleft-single-arrow button, "<".

Version v1.3089

AWS Toolkit for Visual Studio User GuideAdd an IAM User to an IAM Group

http://docs.amazonaws.cn/IAM/latest/UserGuide/ManagingPolicies.html

The lists of groups in the two panes support multiple selection.You can select multiple groups byclicking on them in sequence; you do not need to hold down the control key. To unselect a group,click on it a second time.

To add the IAM user to all the IAM groups, click the right-double-arrow button, ">>". Similarly, toremove the IAM user from all the groups, click the left-double-arrow button, "<<".

3. When you have finished assigning the IAM user to IAM groups, click Save.

Generate Credentials for an IAM UserWith the Toolkit, you can generate certain types of AWS credentials, specifically, the Access Key ID andSecret Key. These can be used to make API calls to AWS. These keys can also be specified in order toaccess AWS services through the Toolkit. For more information about how to specify credentials for usewith the Toolkit, see Specifying Credentials (p. 5). For more information about how to safely handlecredentials, see Best Practices for Managing AWS Access Keys.

The Toolkit cannot be used to generate a password for an IAM user.

To generate credentials for an IAM user

1. In AWS Explorer, right-click on an IAM user and select Edit. A tab for that IAM user appears in theAWS Explorer working pane. Select the subtab labeled Access Keys.

2. To generate credentials, click Create.

Note that you can generate only two sets of credentials per IAM user. If you already have two setsof credentials and you need to create an additional set, select one of the existing sets and clickDelete.

If you want the Toolkit to save an encrypted copy of your Secret Access Key to your local drive,select Save the secret access key locally. AWS only returns the secret access key when

Version v1.3090

AWS Toolkit for Visual Studio User GuideGenerate Credentials for an IAM User

http://docs.amazonaws.cn/general/latest/gr/aws-access-keys-best-practices.html

created.You can also copy the Secret Access Key from the dialog box and save it in a securelocation.

3. Click OK

After generating the credentials, you can view them by selecting them in the Access Keys subtab. If youchose to have the Toolkit save the Secret Key locally, then it will be displayed here.

If you saved the Secret Key yourself and would also like the Toolkit to save it, you can enter it here andselect Save the secret access key locally.

You can also deactivate the credentials by clicking the Make Inactive button.You might do this if yoususpect the credentials have been compromised.You can subsequently re-activate the credentials, whichyou might do if you receive an assurance that the credentials are secure.

Create an IAM RoleThe AWS Toolkit supports the creation and configuration of IAM roles. Similarly to users and groups, youcan attach policies to IAM roles.You can then associate the IAM role with an Amazon EC2 instance. Theassociation with the EC2 instance is handled through an instance profile, which is a logical container forthe role. Applications that run on the EC2 instance are automatically granted the level of access specifiedby the policy associated with the IAM role. This is true even when the application hasn't specified otherAWS credentials.

For example, you could create a role and attach a policy to that role that limits access only to AmazonS3. After associating this role with an EC2 instance, you could then run an application on that instanceand that application would automatically have access to Amazon S3, but not any other services orresources.The advantage of this approach is that you don't need to be concerned with securely transferringand storing AWS credentials on the EC2 instance.

For in-depth information on IAM roles, go to the topic Working with IAM Roles in the IAM User Guide.

For examples of programs accessing AWS using the IAM role associated with an Amazon EC2 instance,go to the AWS developer guides for Java, .NET, PHP, and Ruby.

To create an IAM role

1. In AWS Explorer, under Identity and Access Management, right-click on the Roles subnode andselect Create Roles...

2. Enter a name for the IAM role and click OK.

Version v1.3091

AWS Toolkit for Visual Studio User GuideCreate an IAM Role

http://docs.amazonaws.cn/IAM/latest/UserGuide/WorkingWithRoles.html

http://docs.amazonaws.cn/AWSSdkDocsJava/latest/DeveloperGuide/java-dg-hands-off-secret-management.html

http://docs.amazonaws.cn/AWSSdkDocsNET/latest/DeveloperGuide/net-dg-hands-off-secret-management.html

http://docs.amazonaws.cn/AWSSdkDocsPHP/latest/DeveloperGuide/php-dg-hands-off-secret-management.html

http://docs.amazonaws.cn/AWSSdkDocsRuby/latest/DeveloperGuide/ruby-dg-hands-off-secret-management.html

The new IAM role appears under the Roles subnode of Identity and Access Management.

For information on how to create a policy and attach it to the role, see Create an IAM Policy (p. 92)

Create an IAM PolicyPolicies are fundamental to using IAM. Policies can be associated with IAM entities such users, groups,or roles; and policies specify precisely what level of access is enabled for that user, group, or role.

To create an IAM policy

In AWS Explorer, expand the AWS Identity and Access Management node, then expand the node forthe type of entity to which you will attach the policy: Groups, Roles, or Users. For this discussion, we'llwork with an IAM role. Right-click on the specific group, role, or user (in this case an IAM role) and selectEdit.

A tab associated with the role appears in the AWS Explorer working pane. In this tab, click the Add Policylink.

Enter a name for the new policy.

In the policy editor, add policy statements to specify the level of access to provide the role (in this example"winapp-instance-role-2") associated with the policy. In the example, we show a policy which providesfull access to Amazon S3, but no access to any other resources.

Version v1.3092

AWS Toolkit for Visual Studio User GuideCreate an IAM Policy

For greater precision, you can expand the subnodes associated with services in the policy editor to allowor disallow particular actions associated with that service.

When you are finished editing the policy, click the Save link.

Version v1.3093

AWS Toolkit for Visual Studio User GuideCreate an IAM Policy

Document History

The following table describes the important changes since the last release of the AWS Toolkit for VisualStudio User Guide.

Last documentation update: April 4, 2013

Release DateDescriptionChange

April 4, 2013This release adds support for Amazon Virtual PrivateCloud.

Support for AmazonVPC

June 8, 2012This is version 3.0 of the AWS Toolkit for Visual StudioUser Guide.

New release

Version v1.3094


cloud object storage - aws toolkit for visual studio...

Documents